Which control most effectively mitigates a man-in-the-middle attack against a REST API?

SSL certificates (and the underlying TLS protocol) provide encryption for data in transit and server authentication. This prevents a man-in-the-middle attacker from intercepting and reading sensitive API requests/responses or impersonating the legitimate API server. Password hashes protect stored passwords, not data in transit. Nonrepudiation ensures a sender cannot deny sending a message, but doesn't prevent interception or impersonation. Biometric authentication verifies user identity at the client, not the integrity or confidentiality of the API communication channel.