Maybe a staff member can answer in more knowledgeable detail, but from what I know just by playing around with the plugin.
The Data portion of the command URL depends on what you are sending your command to?
Obviously different devices and applications and services have different HTTP commands they can accept.
The Data portion is the command payload. For example take a look at how I sent http commands with the IP Device Generator plugin to my Hikvision cameras. In that case I had to send data in an XML payload.
As for user name and password if your target HTTP endpoint requires a user name and password then obviously you need to provide them.
I would say this could be done potentially either way, either by putting them in the Data field along with the rest of the data portion of the URL OR put them into the username and password fields when you create the device via the template. But not both, one or the other.