Generally speaking user generated content should not be stored on a Sitecore item because:
- The content is subject to publishing, if stored in the master db, and subject to deletion during publishing if stored in web
- The master database is generally not exposed to the content delivery servers, thus making it impossible to write there in production
Generally speaking for user-generated content the recommendation is to build a purpose-built API, and store the resultant data in some data store of your choosing - or to use Sitecore Forms which includes exactly such a data store (support just landed in 9.2 for JSS)
Aside from architecture, the direct answer to your question is that the location you are storing the form items at needs to have write access granted for the user that is impersonated by the JSS app's API key. Read rights should be denied, since that would make it possible to read all the form data stored there with a malicious API query.