(I develop client SDKS) It could make sense for first-party SDKs for an API to block http access to the first-party API domain, but that should be unnecessary

(I develop client SDKS) It could make sense for first-party SDKs for an API to block http access to the first-party API domain, but that should be unnecessary – typically users would use the default base URL hardcoded in the client library, and only replace it if they're going through some other proxy. When they _do_ go through some other proxy, it's commonly in an internal network of some kind, where http is appropriate and should not be blocked.