At first glance it doesn't look like the SOAP version runs over https.
Is that correct?
At the moment it does not, you are correct. This is something we may look at in the future, and we'll count you as a vote Marc.
Add my vote for SSL for the API.
One more vote for SSL for the API -- is this still on your horizon?