API clients and Tenant App servers communicate over HTTPS, exchanging JSON representations of API objects.