[adakbar]

Is it good to redirect to https when user hit API with http? I have heard somewhere doing so is bad

[SadWebDeveloper]

Nop.. it isn't good, secure endpoints for API's shouldn't be exposed in plain, an error should be raised when a developer/app tries to contact via HTTP rather than HTTPs.

[thatwebdude]

Is 404 sufficient?

[SadWebDeveloper]

Depends on your choice, personally i would choose between 410 or 501 but whatever you choose, just don't allow an implicit redirect with any of the 301/302 codes.

[max23_]

Correct me if I am wrong but even with https redirect, POST request will fail though.