GetDataSourceContents will always return null for the Password member of the instance of DataSourceDefinition it returns

Even though current and past versions of the documentation have never explicitly said so, for obvious reasons the password is no returned . In fact there is no public SSRS API that can return passwords in stored credentials.

Just to let you know until the documentation is improved to include that information.

By reflecting the code you can see for yourself the reason why the password of a stored credential is not retrieved.

Microsoft.ReportingServices.Library.GetDataSourceContentsAction
  internal sealed class GetDataSourceContentsAction: RSSoapAction<GetDataSourceContentsActionParameters>
  {
.
.
.
    internal override void PerformActionNow()
    {
.
.
.
      ActionParameters.DataSourceDefinition =
        Soap2005.DataSourceDefinition.DataSourceInfoToThis(dataSource.DataSourceInfo, false);
}
    }

Microsoft.ReportingServices.Library.Soap2005.DataSourceDefinition
  internal static DataSourceDefinition DataSourceInfoToThis(Data.DataSourceInfo dsi, bool getPassword)
  {
    DataSourceDefinition definition = new DataSourceDefinition();
.
.
.
    if (getPassword)
      definition.Password = dsi.GetPassword(DataProtection.Instance);
    else
      definition.Password = null;
    definition.Enabled = dsi.Enabled;
    definition.EnabledSpecified = true;
    return definition;
  }