I host an API, a webapp (and much more).
I want HTTP requests to the webapp to be redirected to HTTPS -> I use ssl-redirect.
I want HTTP requests to the API to return a 4XX "http_unsupported: This endpoint is only accessible over HTTPS."

Reason:
If an API consumer misconfigures his client to use plain HTTP, he won't know about it but all his secret tokens will be sent plaintext.

See hackernews API Shouldn't Redirect HTTP to HTTPS.

Most APIs (that don't redirect to HTTPS) return a 403, npm returns a 426 with no Upgrade header.