Most of my comments are just "use get_response_type()", so it should be easily implemented. While Response() it the correct type to use when returning values of Blob elements with the appropriate content_type, get_response_type() should be used in all other cases, as it automatically determines whether the client prefers a JSON or an XML response (e.g. for error messages).

Furthermore, you should use the "Return Early" pattern whenever possible. As already stated in several comments, I think the attachment routes shouldn't support File objects for now, at least not with unsanitized paths.

LGTM 👍