Hitoshi,
You need to include the Artifact type in your request. I modified your string:
curl -XPOST -H "Content-Type: application/json" -u 'username:password' 'https://rally1.rallydev.com/slm/webservice/v2.0/iteration/create' -d '{"Iteration":{"endDate": "2018-11-16T00:00:00+09:00","startDate":"2018-11-12T00:00:00+09:00","name":"Iteration#42" ,"project":"166266038080","state":"Planning","sync":"true"}}'
Also, when using a Username and Password instead of an APIKey it will be necessary to use a Security Token. You will need to maintain a session with curl using cookies. Here is an example of doing this:
rally - the same WSAPI v2.0 security key works in a REST client, but produces invalid key error when used with curl - St…
Here is some further information about using curl and the API Key, if you would like to use that method.
WS API request examples using curl and browser RES - CA Knowledge
I hope this helps.
Michael