---
title: "Get image asset"
method: GET
path: "/v1/firearms/{id}/images/{imageId}"
tags: ["Firearms"]
---

# Get image asset

`GET /v1/firearms/{id}/images/{imageId}`

## Request

- Base URL: `https://api.gunspec.io`
- URL: `https://api.gunspec.io/v1/firearms/{id}/images/{imageId}`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Returns the image bytes for one gallery entry. Defaults to the full-size WebP (`variant=display`) with an immutable cache header; `format=datauri` returns a base64 data URI that drops straight into an <img src> with no second request. Images we link rather than host (external sources, asset-CDN paths) answer with a 302 to their location. Listing images and their credits is explorer-tier via /v1/firearms/{id}/images; the bytes are builder-tier, like the silhouette.

**Requires Builder tier or higher.**

## Path parameters

- `id` string, required
- `imageId` string, required

## Query parameters

- `format` 'raw' | 'datauri'
- `variant` 'original' | 'display' | 'thumb'

## Response `200`

The image bytes when `format=raw` (the default), or the JSON envelope when `format=datauri`

- object
  - `success` boolean, required: Always true on a successful response. Every error carries `false` and an `error` object instead.
  - `data` object, required: The response payload.
    - `id` string: Slug of the firearm the image belongs to.
    - `imageId` integer: Numeric id of the image within that firearm image set.
    - `variant` string: Size rendered: `original`, `display` or `thumb`.
    - `format` string: Encoding of the returned image. `datauri` is the only format this route emits.
    - `mimeType` string: Media type of the encoded bytes.
    - `dataUri` string: The image inlined as an RFC 2397 data URI, ready to use as an `<img src>` with no second request.

## Other responses

- `302`: The image is hosted elsewhere; follow `Location`.
- `400`: Validation error
- `401`: Missing or invalid API key
- `403`: The credential is valid and the caller is not permitted. Three causes, none of which reissuing a key changes: the plan is below the endpoint's tier, the account is suspended, or the key is not attached to the thing being acted on, meaning a user account for `/v1/me` or a shop for `/v1/vendor`. Distinct from 401, which means the credential is missing, malformed or expired and a new one can work.
- `404`: Resource not found
- `429`: A limit was reached. `RATE_LIMITED` is the per-minute limit: wait `Retry-After` seconds (a minute) and retry. `DAILY_CAP_EXCEEDED` is the plan's daily limit, per key: nothing will be served until the counters return to zero at midnight UTC. `MONTHLY_CAP_EXCEEDED` is the plan's monthly allowance, for the whole account: nothing will be served until midnight UTC on the first of next month, or until the plan changes. For both, `Retry-After` is the seconds until then and `error.resetsAt` says when as an instant. Calls made after a refusal are refused too and do not spend the month, and a free key that keeps calling is paused, so stop at the first one and resume at the reset.
- `500`: Internal server error

---

[API](https://skmtc.dev/gunspec/apis/gunspec-io-api.md) · [All operations](https://skmtc.dev/gunspec/apis/gunspec-io-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gunspec/apis/gunspec-io-api/revisions/f2e974d8b05c?raw)