“IT Security” consists of very different goals. Encryption describes technologies that may be used to reach these goals, but is not a goal in itself.
One way to look at IT-Sec is the C–I–A triad: confidentiality, integrity, and availability of information. Confidentiality describes that the information is restricted to the intended recipients. For an API, this usually means that:
Users must authenticate themselves when contacting the API, i.e. demonstrate that they are a user who is authorized to access that information. Authentication schemes usually involve crypto (e.g. plaintext password over an encrypted connection, or an asymmetric authentication scheme).
The communication between user and API is confidential, i.e. encrypted. Using a HTTPS connection is an easy way to get that.
Transport encryption without authentication does not ensure confidentiality, because you might have an encrypted connection to an unauthorized user. And plaintext communication with an authorized user does not ensure confidentiality because the communication contents would be visible to other users on the same network and the network providers themselves. So you generally need both.
Not all data needs the same kind of protection. The sensitivity of data is not always obvious (e.g. see the German Tank Problem). However, using encryption with HTTPS has become so easy and cheap that there is no good reason to avoid transport encryption. HTTPS should therefore be treated as a minimum baseline for security.