Combine emailed/API attachments settings.
Make sure ticket api controller enforces attachments settings (don't trust data parsers).