---
title: "Get Template Mask Pixels"
method: GET
path: "/api/hand-templates/{template_id}/mask-pixels"
---

# Get Template Mask Pixels

`GET /api/hand-templates/{template_id}/mask-pixels`

## Request

- Base URL: `https://api.tintin-x.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.tintin-x.com/api/hand-templates/{template_id}/mask-pixels`
- Auth: HTTP bearer

Return each cached SAM3 mask as inline base64 PNG bytes.

The masks editor needs to read mask pixel data into JS-side
`Uint8Array`s, which a direct `<img>`-from-S3 load can't do when
the bucket's CORS config doesn't include the caller's origin
(`getImageData` then throws SecurityError on the tainted canvas).
Serving the bytes through this API endpoint puts them on the
same origin as the rest of the SDK traffic, side-stepping CORS
entirely. ~50-200 KB per mask × 5-10 masks per template — small
enough to be fine on demand from the editor.

## Path parameters

- `template_id` string, uuid, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tintin-x/apis/tintin-api.md) · [All operations](https://skmtc.dev/tintin-x/apis/tintin-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tintin-x/apis/tintin-api/revisions/8839a8d0a66c?raw)