api: default use https url