---
title: "Second-opinion defect check on a rendered view (never fatal)"
method: POST
path: "/api/funko/inspect"
tags: ["funko", "browser-session"]
---

# Second-opinion defect check on a rendered view (never fatal)

`POST /api/funko/inspect`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/funko/inspect`
- Auth: API key in cookie `__session`

Clerk-session only, runId-gated, and NOT paid. FAILS OPEN: no key, an outage, a timeout or an unparseable answer all return 200 with `source: "skipped"` and the run proceeds - blocking a ~34-minute paid run because a cosmetic checker is down is strictly worse. BRANCH ON `source`, NEVER ON `ok`: `ok:true` means 'nothing fatal was found OR nothing looked'. `imageUrl` is allowlisted to the generation CDN and redirects are refused, because this route fetches a caller-supplied URL server-side.

## Request body

- FunkoInspectRequest
  - `runId` string, required
  - `imageUrl` string, required: MUST be on the generation CDN. Redirects are not followed — the host check is a real allowlist, not a sanity check.
  - `view` string

## Response `200`

The verdict. Read `source` to know whether anything actually looked.

- FunkoInspectResponse
  - `ok` boolean, required: true means 'nothing fatal was found OR nothing looked'. Branch on `source`.
  - `defects` string[], required
  - `fatal` boolean, required
  - `note` string
  - `source` string, required: Which checker answered — `skipped` means the check failed open and nothing was actually inspected.

## Other responses

- `400`: Missing imageUrl, or a host outside the allowlist.
- `401`: Not signed in.
- `403`: runId not live or not the caller's.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)