---
title: "Proxy Recipe Image"
method: GET
path: "/api/library/{entity_id}/image"
---

# Proxy Recipe Image

`GET /api/library/{entity_id}/image`

## Request

- Base URL: `https://api.yourbeckett.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.yourbeckett.com/api/library/{entity_id}/image`
- Auth: none declared

Proxy recipe image from S3 — avoids TLS issues with presigned URLs on Railway.

Authorization: owner OR recipient of an active RecipeLibraryShare from the
owner. RecipeLibraryShare rows are hard-deleted on revoke, so row existence
is equivalent to "active share." Any other caller → 404.

Auth transport: same-origin web <img> requests attach the httpOnly
beckett_access cookie (path=/api); iOS CachedAsyncImage attaches Bearer.
Both resolve via get_current_user → extract_token_from_request.

Cache-Control trade-off: 24h browser cache means a recipient who loses
access via share revocation can still see the image from their local cache
until it expires. Acceptable vs. the previous bug (any UUID-holder forever)
and vs. the round-trip cost of shorter TTLs. Shorten if tighter revocation
is needed.

## Path parameters

- `entity_id` string, uuid, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/yourbeckett/apis/beckett-platform.md) · [All operations](https://skmtc.dev/yourbeckett/apis/beckett-platform/llms.txt) · [OpenAPI document](https://skmtc.dev/yourbeckett/apis/beckett-platform/revisions/a1cb8f2c8961?raw)