Looks like only the bottom-level field is required, so the request would be curl -u usr:'psw' -X GET 'https://blah.nexus.com/service/rest/v1/search?sha256=blahblahblah'.
I’ve raised a request to make the /search API doc. more explicit regarding that.