Once enabled in the BitTorrent settings (Preferences -> WebUI), the base URI to access it is http://[IP]:[PORT]/gui/. The data returned by calls is in the JSON format.
Authentication is done with basic HTTP authentication. The guest account, if enabled, is limited to a subset of the calls. Action calls that modify torrent state and getsettings are disallowed.
Unless otherwise noted, each call is done using HTTP GET. Parameters are added onto the base URI like normal. The first parameter should be always the command (e.g. ?list or ?action).
Most action commands require a hash to be passed. This is the infohash of the torrent, obtained from listing all torrents. Each hash is a 40-character ASCII string. Some commands accept multiple infohashes chained together, e.g. http://[IP]:[PORT]/gui/?action=[ACTION]&hash=[TORRENT HASH 1]&hash=[TORRENT HASH 2]&... to cut down on the number of requests required.
When setting boolean values either by ?action=setsetting or ?action=setprops, the value parameter should be sent as 0 for "false" or 1 for "true" rather than a string indicating "true" or "false".