An app's logo

GET 
/public/apps/:slug/logo

The stable address every surface draws a partner app's logo from: 302 to a freshly signed, short-lived URL of the image. A listed app's logo is served bare; any other app's only with a token this server signed (the consent screen and Connected apps carry one). 404 when there is no logo. Throttle: public/apps/logo/ip, 300 a minute.

Request

Responses

302

To the image.

Response Headers

Location

A signed blob path on the API host, valid for 15 minutes.

Cache-Control

Cached five minutes by browsers and CDNs. Every public response also carries Vary: Origin — its CORS headers depend on the caller's origin — so a shared cache keys on it.

400

The request body is not valid JSON.

404

Not found in this workspace — or not something the caller may know exists.

429

A throttle refused the request. Wait Retry-After seconds — the time left in the refusing window plus 0–3 s of jitter. The X-RateLimit-* headers describe the bucket that refused it.

Response Headers

Retry-After
X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset

Seconds until the window rolls.