Could most of the initial API reverse engineering be blocked by using https with certificate pinning?
I tried reverse engineering an Android app API and came up short because every MITM I tried failed, I assume due to certificate pinning. To continue I would have to statically reverse the binary, or root/jailbreak the device and nerf the pinning section of the code.