Are you using OAuth Tokens or just a REST API key? If you are using OAuth, then yes you still need to submit HTML with the request, however it will be parsed and sanitized according to the users permissions to remove anything malicious (excluding those with HTML posting permission - which should be no one other than groups like Administrators). This is ideal for applications that end users submit to directly, like a Desktop app in your case. OAuth also limits requests based on a users permission, so even if they can submit files to the API, they can still only submit to categories they have permission to post to.
If you're just using a REST API key, then it's assumed that the request is coming from a trusted source. This is for things only an administrator has complete control over (typically automated tasks).