---
title: "Avatar Preview"
method: GET
path: "/api/files/{file_id}/avatar"
tags: ["files", "files"]
---

# Avatar Preview

`GET /api/files/{file_id}/avatar`

## Request

- Base URL: `https://api.dialogbrain.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.dialogbrain.com/api/files/{file_id}/avatar`
- Auth: none declared

Public endpoint for avatar images (no auth required).

Downloads from S3 and streams directly with cache headers.
Cached at 3 layers: browser (7d) → nginx proxy_cache (7d) → in-memory dict → S3.

Unauthenticated because the URL is rendered in an `<img src>`, which cannot
carry the Bearer header. That makes the reference check below the ONLY thing
standing between a stranger and the file: serve a file id ONLY when some row
actually points at it as its avatar. Without that check "is it an image?"
was the whole gate, so walking the id space returned every chat photo,
screenshot and post thumbnail of every workspace — 16398 images against 7
real avatars when this was measured.

## Path parameters

- `file_id` integer, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway.md) · [All operations](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/dialogbrain/apis/dialogbrain-v2-api-gateway/revisions/77bef09a9209?raw)