Requests made to Xray's REST API (and also the GraphQL API) must be authenticated using a Client Id and a Client Secret, both of which are based on an API Key created for a specific user in Xray Global Settings: API Keys global settings.
Thus, the first step for you is to obtain the token based on the Client Id and Client Secret of your assigned API Key. You can then use that to make whatever requests to the Xray Cloud.
The REST API base URL for all endpoints is https://xray.cloud.xpand-it.com.
Feel free to contribute!