---
title: "List an event's photo gallery"
method: GET
path: "/api/hack/photos"
tags: ["hack"]
---

# List an event's photo gallery

`GET /api/hack/photos`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/hack/photos`
- Auth: one of:
  - none
  - API key in cookie `__session`
  - HTTP bearer

Either a partner `?grant=` link (published photos only, no account needed) or a Clerk session / agt_ token with `hack:read`, after which the live roster decides: staff see everything in every state, an attendee sees published plus their own. Records are the public projection only - a blob URL never crosses this boundary; bytes come from the separate download route.

## Query parameters

- `eid` string
- `grant` string

## Response `200`

The visible photos. `also_visible_to_you` carries the caller's own non-published rows when there are any.

- HackPhotosListResponse
  - `ok` boolean, required
  - `eid` string, required
  - `via` string: How the caller was admitted: staff | attendee | grant.
  - `count` integer, required
  - `photos` HackPhotoPublic[], required
    - `id` string
    - `eid` string
    - `state` string: pending | published | rejected.
    - `caption` string
    - `credit` string
    - `submitted_at` string, date-time
  - `also_visible_to_you` HackPhotoPublic[]: Present only when the caller can see rows beyond the published set (their own, or staff visibility).
    - `id` string
    - `eid` string
    - `state` string: pending | published | rejected.
    - `caption` string
    - `credit` string
    - `submitted_at` string, date-time

## Other responses

- `403`: No roster access and no valid grant.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)