In your ejabberd.yml you can find this configuration
- port: 5280 module: ejabberd_http request_handlers: "/websocket": ejabberd_http_ws
Enable api and oauth,
- port: 5280 module: ejabberd_http request_handlers: "/websocket": ejabberd_http_ws "/api": mod_http_api "/oauth": ejabberd_oauth
We allow api to have access from other programming languages (JSON request and response)
We allow oauth to raise the api request and get a response (without which, if we get / api access, we get only a 401-unauthorized error)
Once this configuration is complete, give the http request in your browser. URL must be
http://localhost:5280/oauth/authorization_token?response_type=token&client_id=Client1&scope=get_roster+connected_users
get_roster and connected_users are API endpoints . Clinet1 is some name you can give response_type should always be a token
As soon as you click it, it will display the screen as such,

Enter your admin details and click "accept"
Then in the url you will find something like this
http://localhost:5280/oauth/authorization_token?access_token=Ra9W9aRgeoUgIpN0P68SIGDaatDIVcgB&token_type=bearer&expires_in=3600&scope=get_roster%20connected_users&state=
You can see the access token there copyit and make a curl to get connected users. (Enter this command in your terminal)
curl -v POST -H "X-Admin: true" -H "Authorization: Bearer Ra9W9aRgeoUgIpN0P68SIGDaatDIVcgB" http://localhost:5280/api/connected_users -d '[]'
You will get a Json response with all connected users.
This is how you should make API calls in ejabberd. Hope this helps :)