There are 2 sets of API each hosted in 2 different organisations: my client's organisation and her partner's organisation. The servers from the 2 organisations communicate between each other through the APIs hosted in each organisations.
The APIs are already using HTTPS protocol and authenticated using an API key. For my client's case, her servers are on AWS and I have a firewall to only accept her partner's IP.
Since the APIs are already using HTTPS, I would assume that the data transmitted are already encrypted. However, my client has requested that I use an IPsec VPN between the servers.
I'm not sure if I'm missing something here. Since the data transmitted between my client's server and her partner's server through the APIs are already encrypted through HTTPS, is having IPsec still necessary?