Ok, finally I found it. I have to put the parameters and the auth_token (that is also treated as parameter) in :payload
response = RestClient::Request.new(
:method => :get,
:url => base_url + "/" + sub_path,
:user => user,
:password => pwd,
:headers => {:accept => :json,
:content_type => :json},
:payload => {:auth_token => auth_token}.merge(par)
).execute
where par is a hash of parameters. In my case par = {:states = "fail"}