Their API uses XML-RPC and the client encrypts outgoing messages with a blowfish cypher. Incoming messages are in plain text but the url for audio files are partially encrypted with the same cypher but a different key. The two keys used are embedded in the flash object on the official Pandora website although they are obfusticated. Once you can decrypt things though, its just a matter of watching traffic and examining the XML-RPC messages sent back and forth. The method signatures are pretty explicitly stated in our code, although we only implement a subset of the API. There are other open source applications out there like pianobar that implement more of the interface, but frankly, once you can look at the raw XML messages its pretty easy to reverse engineer what is going on.
United States of America
