Could someone make a man in the middle attack between two big companies?

Question

For example a serverless function requests data from a public api (contentful cms). Can someone intervene in that data and modify it?