---
title: "Get short-lived view links for up to 20 of your images"
method: GET
path: "/v1/files/view-links"
tags: ["Files"]
---

# Get short-lived view links for up to 20 of your images

`GET /v1/files/view-links`

## Request

- Base URL: `https://contentmaschine.ai/api`
- URL: `https://contentmaschine.ai/api/v1/files/view-links`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://contentmaschine.ai/api/oauth/authorize`, token URL `https://contentmaschine.ai/api/oauth/token`)

The batch, view-only form of `GET /v1/files/{uuid}/download-link`, built for image
viewers such as the MCP `show_images` tool. No credits are charged, no image is decoded
and no bytes are returned: every entry carries presigned URLs valid for 15 minutes.

- `thumbnail_url` opens a small stored thumbnail inline when one exists, otherwise the
  same image as `view_url`.
- `view_url` opens the original inline in the browser; `download_url` saves it.
- **Every URL is a credential for 15 minutes**: anyone holding it can read the file. Do
  not log it or pass it on.

Only raster images (JPEG, PNG, WebP, GIF, AVIF) stored in object storage get links. Any
uuid that is unknown, not yours, readable only by a container scope your token lacks,
not a raster image (SVG, PDF and others never get inline links), stored only on the
server disk, or not presignable right now is listed in `not_found` instead. One list for
all of these, so it reveals nothing about files you cannot read.

Authorization per uuid is the same two-layer check as the download route: `files:read`
at the gate, then the read scope of the file's own container.

## Query parameters

- `uuids` string[], required

## Response `200`

View links for the images that can be shown, and the uuids that cannot.

- object
  - `success` boolean
  - `data` object
    - `images` object[]
      - `uuid` string, uuid
      - `file_name` string
      - `mime_type` string
      - `width` integer, nullable
      - `height` integer, nullable
      - `thumbnail_url` string: Presigned inline URL for a small version. A credential.
      - `view_url` string: Presigned inline URL for the original. A credential.
      - `download_url` string: Presigned download URL for the original. A credential.
      - `expires_at` string, date-time
    - `not_found` string[]
    - `expires_at` string, date-time
    - `expires_in_seconds` integer
  - `timestamp` string, date-time

## Other responses

- `400`: `uuids` is missing, holds something that is not a uuid, or names more than 20 files.
- `401`: Missing or invalid API key.
- `403`: The token does not hold files:read.
- `default`: Any other error. Every failure this API emits uses the same envelope; branch on `error.type`, never on `error.message`, and quote `error.correlation_id` to support.

---

[API](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api.md) · [All operations](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contentmaschine/apis/contentmaschine-ai-api/revisions/28c74f46051c?raw)