Pass multiple parameters with http get request ASP.NET Core Web API

I have this controller:

[Route("[action]/{phone}/{password}", Name="PhoneLogin")]
[HttpGet]
public async Task<ActionResult<User>> PhoneLogin(string phone, string password)
{
    var response = await _repository.PhoneLogin(phone, password);

    if (response == null)
    {
        return NotFound(); 
    }

    return Ok(_mapper.Map<UserReadDto>(response));
}

public async Task<User> PhoneLogin(string phone, string pass)
{
    StringCipher s = new StringCipher();

    using (SqlConnection sql = new SqlConnection(_connectionString))
    {
        using (SqlCommand cmd = new SqlCommand("spPhoneLogin", sql))
        {
            cmd.CommandType = System.Data.CommandType.StoredProcedure;

            cmd.Parameters.Add(new SqlParameter("@phone", phone));
            cmd.Parameters.Add(new SqlParameter("@password", s.EncryptString(pass)));

            User response = null;

            await sql.OpenAsync();

            using (var reader = await cmd.ExecuteReaderAsync())
            {
                while (await reader.ReadAsync())
                {
                    response = MapToValue(reader);
                }
            }

            return response;
        }
    }
}

I'm new to APIs. I'm trying to send two parameters with the request. How is the URI constructed in that case?

Based on your routing attribute [Route("[action]/{phone}/{password}", Name="PhoneLogin")], the method can be reached under /PhoneLogin/anyString/anyOtherString where anyString would be bound to phone and anyOtherString to password.

If you have an additional route attribute on the controller class, such as [Route("[controller]")], the name of your controller also needs to be added which results in /MyControllerName/PhoneLogin/anyString/anyOtherString.

Please take a closer look at the documentation on model binding and routing fundamentals. The default model binding follows a predefined order, which (based on the documentation) is

1. Form fields
2. The request body (For controllers that have the [ApiController] attribute.)
3. Route data
4. Query string parameters
5. Uploaded files

So since no form fields or request body is provided (which is the most common case for a get-request), the route data is used to bind the two parameters.