Sounds good Ryan, thanks. We're looking at the Hosted Payment Page method rather than XML API to negate the need for SSL, although it could be nice for the customer to not have to leave the merchant's web site. Reading your other post on this issue, it sounds like we'd need to check that the XML API is actually set up for the account.

Edit: I'm having a go at the Hosted Payment Page side of things. It'll be a learning experience as I know nothing about the Ubercart API at this stage.