diff --git a/app/api/staff/report/route.ts b/app/api/staff/report/route.ts
index d597d4f..c13e3ce 100644
--- a/app/api/staff/report/route.ts
+++ b/app/api/staff/report/route.ts
@@ -381,7 +381,14 @@ async function buildLivePayload(orgId: number): Promise<StaffReportPayload> {
         {
           // APIv3 takes id as an IN-clause via the {IN: [...]} operator object.
           id: { IN: Array.from(fileIds) },
-          return: ["id", "url"],
+          // APIv3 expects `return` as a comma-separated string. Passing an
+          // array crashes Civi's error pathway on htmlentities() — that's
+          // v4 syntax.
+          return: "id,url",
+          // sequential: 1 forces values to be returned as a plain array
+          // rather than an object keyed by id. The civi3 helper normalizes
+          // either, but the array form is the canonical APIv3 client shape.
+          sequential: 1,
           options: { limit: 0 },
         },
       );