Supplying only a username and password in the body is sufficient for most users.

Example:

{
  "username": "[email protected]",
  "password": "abc123"
}

You can use the resulting token property in the api_key field above to access all other API calls.