That is not URL encoding, that is HTML entity encoding.
By default, the API returns "safe" values; see the filters doc:
Any string returned as a result of an API call with a safe filter will be inline-able into HTML without script-injection concerns. That is to say, no additional sanitizing (encoding, HTML tag stripping, etc.) will be necessary on returned strings.
That means that special characters (<>'"&
, etc.) will be HTML entity encoded by default.
If you run the same query with an "unsafe" filter (See the doc), you can often get the raw values:
{
"items": [
{
...
"user_id": 562459,
...
"display_name": "Mike Sherrill 'Cat Recall'",
...