They are still susceptible in XSS attacks,
plain/text JSON enforcement, and if the origin policies aren't set up correctly. It's been answered before on Stack Overflow, but not here really. The answer on Stack Overflow can be found here but I'll summarize here for archival sake:
Forms are limited to two methods:
Forms are limited to three content types:
Since you're posting over content-type
application/json you need to use
XMLHTTPRequest submission which is locked down with Origin Policies(Same, Cross) so now it depends on the server.
However, if the form generates valid JSON but sets the content type to
text/plain and the server doesn't check that then CSRF is still possible if all the server is doing is parsing the data without checking the content type.
So really it's up to the server to check the post request, only allow content-type
application/json and use correct origin policies to prevent CSRF with a JSON API. Remember CSRF is always dependent on the server to prevent the attack.