From your question it is not clear if you are vulnerable or not.
Is the token fixed or is it a cryptographically strong random generated token? if it is fixed it is of no value.
Are you using SSL? if not your token can be sniffed and stolen - it is highly recommended that you use SSL.
Note also that it is not recommended to pass the token in the url. URL's are sensitive since they are subject to logging in many places such as browser history, network appliances etc... https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Disclosure_of_Token_in_URL
How do you validate in the server side that the token is valid? do you keep it in the server session? Usually REST API's are designed to be stateless - meaning no session should be kept. If you want to stick to this rule you should create the token in a http-only cookie and upon every API call send the cookie value as part of the request. Your API should then check that the cookie value is same as the token in the request.
An attacker could not read the cookie and hence would not be able to send the correct token in the request.
this is a nice blog about it: http://blog.codinghorror.com/preventing-csrf-and-xsrf-attacks/