Serve the authorized indexed renderer with access-checked, private no-store thumbnail bytes.

GET

/api/v1/files/thumb/{hash}

const url = 'https://example.com/api/v1/files/thumb/example?s=1&kind=media&v=2';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://example.com/api/v1/files/thumb/example?s=1&kind=media&v=2' \
  --header 'Authorization: Bearer <token>'

Route: /api/v1/files/thumb/{hash}. Inputs: hash, s, kind, v. Safe reads can use bounded retries.

Authorizations

installationBearer
browserSession

Parameters

Path Parameters

hash

required

string

Query Parameters

required

integer format: int32

kind

Public names for the renderer families carried by Files thumbnail URLs.

string

Allowed values: media pdf text-card

Renderer family. Omission keeps existing media URLs valid.

integer format: int32

>= 1 <= 2

Legacy v=1 and current v=2 URL identities are accepted; private thumbnail bytes are never cached.

Example

Responses

200

image/webp

404

application/json

The standard API error response: { "error": { ... } }.

object

error

required

Error details.

object

code

required

Stable machine-readable code.

string

Allowed values: bad_request unauthorized forbidden not_found conflict name_conflict_case name_too_long push_endpoint_rejected too_many_requests internal service_unavailable

details

One of:

object
null

Optional field or operation details.

object

key

additional properties

string

message

required

Safe text for logs or a user-facing error message.

string

Example

{
  "error": {
    "code": "bad_request"
  }
}