I think this would be relatively straightforward to write as a plugin or theme component, some kind of embeddable entity which can make these actions for you. The issue with the AJAX code posted above is that you are sending the global all users API key to the client. This is totally a bad idea.
The issue you will have with creating a link, as per the OP, is that the API call requires a REST POST action and links can only issue a REST GET action.