Yes, HTTPs is a requirement for any client connection. No matter whether it is the Web GUI, console proxy or API.
This can be seen in the API examples and is also indirectly in the Release Notes:
vCloud Director requires client connections to be secure.
Thanks for the quick reply. ( I felt the same way)