attachment routes return JSON in their body