I have encountered an issue similar to this one where I get 400 "protocol.http.InvalidPath" with raw square bracket ([ and ]) or encoded square bracket (%5B and %5D). For example:
https://my.apigee.host/api/files[].txt
or
https://my.apigee.host/api/files%5B%5D.txt
I did further testing with other special characters, both raw and URL encoded, in path and in query parameter, and here is what I observed:
No matter whether the brackets are encoded or not, error message always shows raw brackets like:
Came across this topic from another inquiry. I think the right answer is this is working as expected considering RFC 3986 Appendix D January 2005 - https://datatracker.ietf.