An API key that gets sent secretly in the header or query (from your Moodle account)
The endpoint / url you are requesting data from
To know what you are sending to Moodle to get or post the correct data e.g. if you’re uploading content for a cms, you’ll need to append it to the body as part of the http request
This token should then be passed in the “core_user_get_users” or other requests as it validates that YOU as a user are making a request. I can’t see exactly the terminology but it seems to be ‘token’ in name, then the actual token value you’ve received from your login request in value