https://apps.garmin.com/en-US/apps/da3db127-3938-4dac-bcf1-e30324fd0d20
I've checked with tshark and the actual URL has "? at the end:
HTTP 277 GET /json.htm?type=command¶m=switchlight&idx=479&switchcmd=Toggle? HTTP/1.1
It shouldn't tough :)
json.htm?type=command¶m=switchlight&idx=479&switchcmd=Toggle&
$ curl -X POST -H "x-ha-access: YOUR_PASSWORD" \
-H "Content-Type: application/json" \
-d '{"entity_id": "switch.christmas_lights"}' \
localhost:8123/.../turn_on