Serve Thumbnail

GET 
/api/public/media/thumb

Stream a media-library thumbnail JPEG.

Self-authenticating via an HMAC signature over (tenant_id, path) so bare <img src=…> can load the URL without sending an auth header. The service-level sandbox forbids serving anything outside a .thumbs/ segment so a forged signature can never reach a non-thumbnail object.

Request​