I ran to this very same problem, and finally found a solution for it.
The key is to send NULL character along the key parameter. This can be done by setting the parameter with value %00, i.e., key=%00
Below is an example utilizing cURL, with POST method, switch -d is for application/x-www-form-urlencoded. Notes:
- [] is optional, in the case you have set basic auth for the device
- <> you need to set your own information in this space