It's unclear why the API in general converts from the internally-stored base-36 representation to base-16, except maybe because people usually use base-16 for hashes so it's less likely to be surprising. The first addition of a "sha1" parameter in the API appears to be gerrit 25456.
Version: 1.25-git
Severity: enhancement