I realized that I'm missing a trailing / (forward slash) between rest endpoint and query parameter that lead to Mixed Content insecure XMLHttpRequest endpoint.