Sorry, this is a half-answer.
The HTML encoding is being added because this line is adding default 'wrapper' functions that include adding HTML entities (
You can fix this by altering the defaults passed into
WrapperAdapter::construct(), to include
'content' in the array of
skipFields. I think you could do this here.
Just add a line like
'content', // For attachment.create
This does work - I tried it.
However this may not be secure because I don't know if any of the other APIs use the rather generic 'content' parameter name. If they do, then removing the protection afforded could result in XSS vulnerabilities or other problems.
So the other way to fix it would be rename the API
content something more unique
attachment_content - but that would require changing a public API (!)
So another way would be to put in some sort of check that changes the default wrappers for the particular case of
attachment.create, but I'm not familiar enough with the internal workings of the API system to suggest that patch.