Regardless of the rate booked the access to the API can be done encrypted over https or unencrypted over http.
It is generally recommended to work only over an encrypted connection because the data is otherwise transferred in plain text and can potentially be read.
