The bytes of one pre-release figure

Served by the application rather than from object storage, and re-checked against your supplier scope on every request — a URL is not a permission. Answers 404 both for a figure that does not exist and for one that is not yours, deliberately: telling you a figure exists but belongs to somebody else is itself a fact about another manufacturer's unpublished work.