how to save multiple objects to the database in django rest framework views

I suggest you change your models.py structure to this:

from django.db import models

class Category(models.Model):
    category = models.CharField(max_length=20, null=True, blank=True)
    created_on = models.DateTimeField(auto_now=True)
    
    class Meta:
        verbose_name_plural  =  "Categories"

class Picture(models.Model):
    image = models.FileField(upload_to='shop/images')
    product = models.ForeignKey(to=Products, on_delete=models.CASCADE)
    created_on = models.DateTimeField(blank=True, default=datetime.now)
    
class Product(models.Model):
    name = models.CharField(max_length=35, null=False, unique=True)
    description = models.CharField(max_length=255)
    price = models.DecimalField(max_digits=10, decimal_places=2, default=0.)
    main_image = models.FileField(upload_to='shop/images')
    more_images = models.ManyToManyField(Pictures, on_delete=models.CASCADE)
    category = models.ForeignKey(Category, on_delete=models.CASCADE)
    created_on = models.DateTimeField(auto_now=True)

Then in your serializer.py add:

from rest_framework import serializers
from .models import Category, Picture, Product

class CategorySerializer(serializers.ModelSerializer):
    
    class Meta:
        model = Category
        fields = "__all__"

class PictureSerializer(serializers.ModelSerializer):
    
    class Meta:
        model = Picture
        fields = "__all__"

class ProductSerializer(serializers.ModelSerializer):
    
    class Meta:
        model = Product
        fields = "__all__"

In your views, I suggest you use ViewSets: views.py

from .models import Category, Picture, Product
from .serializer import CategorySerializer, PictureSerializer, ProductSerializer
from rest_framework import viewsets
# import custom permissions if any

class CategoryViewSet(viewsets.ModelViewSet):
    
    serializer_class = CategorySerializer
    queryset = Category.objects.all()

class PictureViewSet(viewsets.ModelViewSet):
    
    serializer_class = PictureSerializer
    queryset = Picture.objects.all()

class ProductViewSet(viewsets.ModelViewSet):
    
    serializer_class = ProductSerializer
    queryset = Product.objects.all()
    permission_classes = [IsModerator]

In your app's urls.py, add the router for your viewsets and it will create the paths for your views automatically:

from django.urls import path
from rest_framework.routers import DefaultRouter

router = DefaultRouter()
router.register(r'category', views.CategoryViewSet, basename='category')
router.register(r'picture', views.PictureViewSet, basename='picture')
router.register(r'product', views.ProductViewSet, basename='product')

urlpatterns = [
    path('', include(router.urls)),
]

Changes log:

• You do not need to add an ID field to every model, Django does that for you. Unless it's a particular case.
• Your database tables are named after your model by default. So no need to specify that too.
• I simplified your models' structure to make it cleaner. But it still does what you want it to do.
• Django adds an s to create a plural name for every model. So you can name it in singular form unless needed to specify. eg. categories.
• The viewsets will reduce your work by providing you with listing and retrieval actions.

To access a specific instance of eg. a product, you will just add a /<product id> after the product listing and creation endpoint.

Note: You have to add the id without the brackets.

I also suggest you go through this DRF tutorial. It will improve your understanding of Django REST framework.