REST call:
http://[domain]/rest/cms.avatar
should return the data but this will not include the file data.
If you haven't figured it out yet, by default both attachments and avatars are stored in the same format in the DB, but different tables. Where the file is stored as Binary data.