[rattray]

(I develop client SDKS)

It could make sense for first-party SDKs for an API to block http access to the first-party API domain, but that should be unnecessary – typically users would use the default base URL hardcoded in the client library, and only replace it if they're going through some other proxy.

When they _do_ go through some other proxy, it's commonly in an internal network of some kind, where http is appropriate and should not be blocked.