Actually the spec might be irrelevant here - I don’t think you can return a PDF from a JSON API endpoint. I think you have to expose the URL for the PDF as an attribute, then interact with that. But that endpoint is not governed by JSON API, so you can do whatever you like there. You might be interested in this discussion