Skip to content

Fetch the operator-uploaded instance logo

GET
/appearance/logo

Streams the operator-set logo image, or 404 when none is set — a 404 here is the normal, expected state of a default install and means “render the shipped default mark”, not an error.

Unauthenticated for the same reason /appearance is: the logo is chrome on the sign-in page, so an install that refused it anonymously could not draw its own login card. Nothing is disclosed by serving it — an operator who uploads an instance logo is by definition publishing their branding.

Content-Type is the type derived when the image was decoded at upload, never a client-supplied string. The response also carries X-Content-Type-Options: nosniff and a lockdown Content-Security-Policy, so a file that somehow got past validation still cannot be rendered as an active document.

Callers should request the URL published as logo_url on /appearance, which carries the content hash as v. Responses are immutable for a given v, so the URL changing IS the cache invalidation.

v
string
/^[0-9a-f]{64}$/

Content hash of the logo to serve. Omit to get whichever logo is currently active.

This doubles as the cache-buster and as the addressing scheme for the admin picker, which renders a thumbnail per entry in logo_history. The hash is resolved only against that list — an unlisted hash is a 404, so this cannot be used to read arbitrary objects out of storage.

The logo image

string format: binary

Resource not found

object
error
required

Human-readable error summary

string
Example
the request could not be completed