What are some of the practical risks that come with a server-to-server connection over http (not secured with https/SSL)? There are no users involved, just a B2B connection from one company to another.
Business A will call a web service endpoint at Business B. An API key will be included in the call to be used to gate access (e.g., key must be valid, in good standing).
I know it is possible to snoop the traffic. Not sure this is likely, just possible. How does one reason about the associated risk?
What are other practical risks?
EDIT: For additional context, some public web APIs support http-based calls with key passed either in payload or URL. For example: Posterous, Tumblr (new API supports OAuth over http), Bing, GoodGuide and Flickr.