Should the password be plain text when creating a user through the API?

[spirobel]

if you want to go the extra mile, you can do certificate pinning in your APP to make sure there is no man in the middle attack.