# `GET /thumb/{fullHash}`

Protected. Requires a valid session cookie (`credentials: 'include'`).

Thumb image by hash

Returns the thumb AVIF for `pic.hash` (fullHash — not thumbhash).
Auth via article category access. Browser-cacheable (`private`, `immutable`, `ETag`).


## Path parameters

| Param | Required | Type | Description |
|-------|----------|------|-------------|
| `fullHash` | yes | string | SHA-256 hex of the full image bytes |

## Response `200`

AVIF thumb bytes

## Errors

| Status | Description |
|--------|-------------|
| 304 | Not modified (If-None-Match matched ETag) |
| 400 | Invalid hash — `{"error":"…"}` |
| 401 | Unauthorized — `{"error":"…"}` |
| 403 | Not authorized — `{"error":"…"}` |
| 404 | Image not found — `{"error":"…"}` |

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._