The following characters cannot be used in the API URL, as they are reserved characters and can be used in attacks:
# % & * + / ? : . < >