You are correct about that; you could do HTTPS (or otherwise TLS) too would also work, to define such API; it does not have to be SSH. (Actually, now that I co

You are correct about that; you could do HTTPS (or otherwise TLS) too would also work, to define such API; it does not have to be SSH. (Actually, now that I consider, HTTP requests (with HTTPS) might be better than SSH anyways for many of the things being done, such as downloading a bank statement. So, it may likely do better. However, the common authentication protocols are better in SSH, but similar kind of authentication protocols is probably still possible with HTTPS too, just it does not seem to be as commonly used, but perhaps it should be.)