Get a single asset by id
GET/assets/:id
Returns the single usable asset with the given stable Mocart asset document id. Add ?showDeleted=true to read a deleted asset too (the body then carries deletedAt). The strong ETag header identifies the asset state; send it back as If-Match on a write.
Request
Responses
- 200
- 401
- 403
- 404
- 429
OK. The single asset.
Response Headers
Strong hash of the asset state, sent on the plain read and on a deleted asset read with ?showDeleted=true. Send it back as If-Match.
Unauthorized. Missing, malformed, unknown, revoked, or expired bearer token — or the token owner no longer holds the required entitlement (ENTITLEMENT_LOST). A uniform problem body is returned with a distinct code; no owner/condition detail (no-leak).
Forbidden. The token does not carry the required scope (API_TOKEN_SCOPE_DENIED).
Not Found. No asset matched the identifier (ASSET_NOT_FOUND). A cross-tenant, soft-deleted (without ?showDeleted=true), or non-usable (no stored url) asset id returns this SAME uniform 404 (no-leak).
Too Many Requests. The per-token sliding window of 200 requests/minute was exceeded. The body is express-rate-limit's DEFAULT plain-text message (NOT the JSON problem+json envelope).
Response Headers
IETF draft-7 rate-limit policy/state (limit, remaining, reset).
Seconds to wait before retrying.