The REST API is where plans, subscriptions, add-ons, and invoices get created and managed from your own code instead of the dashboard. It's the layer most custom work builds against: signing someone up, changing a plan, issuing a credit, all callable instead of clicked.
recurly.js runs in the browser and handles the card form itself, either through Recurly's hosted fields embedded in your own page or through Recurly's fully hosted payment pages if you'd rather not build a form at all. Either way, the goal is the same: raw card data goes straight to Recurly, not through your server, which keeps most of PCI scope off your plate.
Webhooks are how your own systems find out something changed without polling the API. A new subscription, an upgrade or downgrade, a cancellation, a successful or failed payment, each can trigger a webhook, and what you do with that notification is entirely up to whatever receives it.