Read avatar image

Outcome

Read a raster avatar by its opaque published URL. Avatar images are public to anyone holding that URL.

Captures exercise real Auth/workspace handlers and canonical isolated SQL. Identity, Brand responses and the object store are simulated.

Before you start

• Discover the current uploaded UUID from the authorized profile/workspace URL. This read needs no authentication and grants no authority to change a photo or enumerate other opaque ids.

• Uploaded raster URLs are public to anyone holding the URL and permit a five-minute browser cache. Use an image suitable for public access; replacing/removing stored bytes cannot recall downloaded or cached copies.

Discover the target

topolo whoami --json
topolo actions get app_topolo_auth.avatars.content --detail --json

Read me.get for the same authenticated human, or workspaces.list for the exact target app/organization, to resolve its current photo and uploaded UUID.

Input fields

Effects

• Reads the public stored raster as JSON/base64 without changing its binding or bytes.

Interpret the response

This published action returns a JSON success envelope, not a raw image: data.id is the opaque UUID, data.url is the browser raster URL, contentType is the detected MIME type and contentBase64 contains the same bytes. The browser URL and action path are different representations of the same stored object.

The target image is public to anyone holding its opaque URL. Normal credential-scoped catalog discovery is distinct from the target’s anonymous image-read behavior. Discover its current id from the authorized profile/workspace; do not guess ids or confuse a Brand asset URL with an Auth uploaded image.

Missing/replaced images return HTTP 404 with plain text Not found; unavailable avatar storage returns HTTP 503 with plain text Avatar storage unavailable. These are unstructured target responses; CLI/SDK callers must handle http_error/status rather than invent a JSON service error code.

The browser raster response uses public max-age=300, nosniff and a sandbox content policy. Server removal cannot revoke cached or downloaded copies. A successful read proves those bytes at the observation time, not enrollment, private access, ownership, renderer compatibility or persistence durability.

Worked examples

All ids, public URLs and raster bytes below are synthetic local fixtures. Resolve authorized live targets and review the exact unchanged plan before execution. These raw target responses do not prove the live gateway, provider persistence, public rendering or cache invalidation.

Opaque published id returns the same raster bytes as a JSON envelope

Input · payload.json:

{
  "avatarId": "00000000-0000-4000-8000-000000000001"
}

CLI:

topolo actions validate app_topolo_auth.avatars.content --data @payload.json --json
topolo actions plan app_topolo_auth.avatars.content --data @payload.json --json
topolo actions call app_topolo_auth.avatars.content --data @payload.json --detail --json

MCP call after topolo_validate_action and topolo_plan_action on this same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.avatars.content",
    "input": {
      "avatarId": "00000000-0000-4000-8000-000000000001"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Success",
  "data": {
    "id": "00000000-0000-4000-8000-000000000001",
    "url": "https://auth.topolo.dev/api/avatars/00000000-0000-4000-8000-000000000001",
    "contentType": "image/png",
    "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+a8ioAAAAASUVORK5CYII="
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Fresh discovery uses the replacement opaque id

Input · payload.json:

{
  "avatarId": "00000000-0000-4000-8000-000000000002"
}

CLI:

topolo actions validate app_topolo_auth.avatars.content --data @payload.json --json
topolo actions plan app_topolo_auth.avatars.content --data @payload.json --json
topolo actions call app_topolo_auth.avatars.content --data @payload.json --detail --json

MCP call after topolo_validate_action and topolo_plan_action on this same input:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.avatars.content",
    "input": {
      "avatarId": "00000000-0000-4000-8000-000000000002"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Success",
  "data": {
    "id": "00000000-0000-4000-8000-000000000002",
    "url": "https://auth.topolo.dev/api/avatars/00000000-0000-4000-8000-000000000002",
    "contentType": "image/png",
    "contentBase64": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+a8ioAAAAASUVORK5CYII="
  },
  "timestamp": "2026-10-03T00:00:00.000Z"
}

Verify the result

• Match data.id to the discovered UUID and compare contentType/decoded contentBase64 to the expected image.

• The returned browser URL serves those bytes separately; verify actual rendering when needed.

Errors and recovery

Replaced object is absent at the server although cached/downloaded copies may remain

Input:

{
  "avatarId": "00000000-0000-4000-8000-000000000001"
}

Captured local refusal · HTTP 404 · text/plain;charset=UTF-8:

Not found

Missing public image storage returns an unstructured unavailable response

Input:

{
  "avatarId": "00000000-0000-4000-8000-000000000001"
}

Captured local refusal · HTTP 503 · text/plain;charset=UTF-8:

Avatar storage unavailable

Published recovery guidance

• http_error (HTTP 404): Discover the current uploaded id; replaced/removed objects return plain-text Not found.

• http_error (HTTP 503): Preserve sanitized status evidence and involve the authorized storage maintainer; no image repair action is published.

Recovery boundaries

This read has no rollback. Refresh the authorized profile/workspace and use its current uploaded image id after replacement/removal. Respect missing/unavailable responses and do not enumerate other opaque ids.

Discovery and evidence

This record belongs to Auth. Candidate human/machine URLs become valid only after native publication. Real canonical core/access migrations, identity/workspace SQL, raster validation, Brand response parsing and JSON/binary response construction were exercised. In-memory image storage, identities, seating, Brand workspace discovery and HTTP responses, ids/clock and fault injection are simulated. No live user photo, workspace avatar, Brand publication, OAuth state or Cloudflare object was changed.