WordPress REST API custom endpoint not allowing multiple parameters

Short answer to a long question:

I needed quotation marks round the URL.

curl -X GET "https://example.com/wp-json/foo/v1/bar?posts_per_page=1&paged=2" -H "Authorization: Basic xxxxx"