The site's icon for one domain, from our cache, fetched once per domain

The domain is a bare host: lower-case, no scheme, no port and no path, and never an address. On a miss, or past the cache's TTL, the API asks Google's favicon service about that domain once, under a three second deadline, with the domain as a query parameter of one fixed upstream url and never as a host the caller chose. A redirect is not followed. A 64 KB cap and an image content-type allowlist finish it, and the upstream's own 404, which is what it answers for a domain it has no icon for, is stored as no icon. A domain with no icon we will serve answers 204, which is the client's signal to draw a monogram. No client ever fetches an icon itself.