The API requires three characters to be escaped. I think the Conversation activity should do that for the caller: `$text = str_replace(['&', '<', '>'], ['&', '<', '>'], $text);`