Unless the API deals exclusively with returning HTML I&#x27;d vote it is the consumer&#x27;s responsibility.  It is impossible for the API producer to know in what context the consumer intends to use it. For example, what if the API consumer is an iOS application and intends to use it in a non-webview? The API should return raw data and leave it up to the consumer to decide how it will be used and what sorts of escaping may be necessary.