If you are updating records via the API with text that has special characters like ampersands embedded in the text, you must first encode these.
see :
https://www.w3schools.com/tags/ref_urlencode.asp
e.g.
To update the client name to "New Company & Co",
this needs to be passed to the api as "New Company %26 Co"
http://<SERVER>/jsonapi/clients.json?user=user&password=user&version=3.9&action=update&input={
"data": [
{
"clientCode": "1/P0909",
"clientName": "New Company %26 Co"
}
]
}