Serves a specific stored variant of the avatar image — 48 (thumbnail) or 256 (full size). These are the URLs returned as path-small and path-large by the avatar metadata endpoints.No authentication required — avatars are public by design so any UI can embed them directly in an <img> tag.Caching:Cache-Control: public, max-age=2592000 (30 days), plus Expires, Last-Modified and a strong ETag. Conditional requests are answered with a bodyless 304: send If-None-Match (preferred) or If-Modified-Since.Formats: avatars are stored as WebP. Request the same hash with a .jpg or .png extension and the image is transcoded on the fly and cached on disk, for clients that cannot render WebP.Filenames are opaque MD5 hashes and are validated against ^[a-f0-9]{32}\.(jpg|png|webp)$ — they carry no user information and cannot be used to enumerate users.