I have had this come up a few times and thought the answer would benefit all.
To answer your question, they need to use a HTTP POST and transmit the IPs in the body. they can use --data-binary with their calls if they wish, as that has nothing to do with the API parameters itself.
--data-binary is a curl SPECIFIC flag for curl itself. it has nothing to do with HTTP web services call specifically, but it's how you "POST" data to the call in the HTTP BODY instead of in the header WHEN using curl. Here's an example in Postman, where I pass the URL parameters into the call VIA THE URL itself in form-data. This would be limited by how long the accepting web server can handle in a URL call (which for Apache on Qualys servers is about 8190 (approx 8K) characters).
So if you go over that, you need to pass it in the BODY itself, and you do that you can use x-www.form-urlencoded and add a HEADER of Content-Type: application/x-www-form-urlencoded and then you would be able to go up to the limit, which is 16MB.
You can also use variations of raw and binary and pass appropriately into the body of the call as well. For example in our PORTAL API's we pass XML into the body via Content-Type: text/xml
If you are curious more detail here: https://en.wikipedia.org/wiki/List_of_HTTP_header_fields and here: https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol If you are really curious for the nitty gritty details (and you have run out of Ambian) grab the RFC https://tools.ietf.org/html/rfc7231