---
title: "Design Image"
method: GET
path: "/v1/mcp/design-image"
tags: ["mcp-iframe-design-upload"]
---

# Design Image

`GET /v1/mcp/design-image`

## Request

- Base URL: `https://api.evidenso.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.evidenso.com/v1/mcp/design-image`
- Auth: none declared

Stream a GCS image for the design_annotations rich-UI card.

Auth is the HMAC over the exact `path` (minted by `build_image_url` at the
MCP chokepoint) — the sig only ever covers paths the server itself chose to
expose, and can't be forged for other paths. No Firebase token needed, so
the sandboxed iframe can load it directly via `<img src>` (img-src CSP
whitelists this origin via `_meta.ui.csp.resourceDomains`).

## Query parameters

- `path` string, required: GCS object path.
- `sig` string, required: HMAC signature over the path.

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/evidenso/apis/persona-rag-api.md) - [All operations](https://skmtc.dev/evidenso/apis/persona-rag-api/llms.txt) - [OpenAPI document](https://skmtc.dev/evidenso/apis/persona-rag-api/revisions/86408c178d4f?raw)