This question already has an answer here:
Since GET parameters are passed in the url, how can they be secure from someone with access to network logs. He would be able to see what urls are accessed, even if he cannot see the request and response.
I ask because an api requires me to pass user data over https(their user's data ofc). The username and password are passed as http AUTH: user:email@example.com/api/messages