Can reflected XSS (cross site scripting) attack happen on a REST API which serves non HTML response

Question

Can reflected XSS (cross site scripting) attack happen on a REST API which takes in a XML request payload, serves a XML response. There is no html content in the request or resp