> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spoofsense.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Retrieve the captured selfie

> Called from your backend with the secret key — the sst_ client token can never reach this endpoint. Mints a signed URL to the exact bytes the models scored, valid for 5 minutes; fetch immediately rather than storing the link. Verify the download against `sha256`. Every retrieval is written to your org's media access log. Available as soon as the decision is — the upload happens during capture.



## OpenAPI

````yaml /api-reference/openapi.json get /v1/verification_sessions/{id}/media
openapi: 3.1.0
info:
  title: SpoofSense API
  version: '1.0'
  description: >-
    Face liveness and deepfake detection. All errors use the envelope `{"error":
    {"code", "message"}}`. Input errors (4xx) are never charged.
servers:
  - url: https://api.spoofsense.ai
security:
  - secretKey: []
tags:
  - name: Detection
    description: >-
      Stateless checks on an image you already have. Authenticate with your
      secret key.
  - name: Verification sessions
    description: >-
      The secure capture flow used by the SDKs and hosted page. Server-side
      calls use the secret key; client-side calls use the session's sst_ token.
  - name: Service
paths:
  /v1/verification_sessions/{id}/media:
    get:
      tags:
        - Verification sessions
      summary: Retrieve the captured selfie
      description: >-
        Called from your backend with the secret key — the sst_ client token can
        never reach this endpoint. Mints a signed URL to the exact bytes the
        models scored, valid for 5 minutes; fetch immediately rather than
        storing the link. Verify the download against `sha256`. Every retrieval
        is written to your org's media access log. Available as soon as the
        decision is — the upload happens during capture.
      operationId: getVerificationSessionMedia
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The vs_… session id.
          example: vs_1f2e3d4c5b6a79880917263544332211
        - name: redirect
          in: query
          required: false
          schema:
            type: boolean
            default: false
          description: >-
            When true, respond with a 302 straight to the image bytes instead of
            JSON.
      responses:
        '200':
          description: Signed media link
          content:
            application/json:
              schema:
                type: object
                properties:
                  object:
                    type: string
                    enum:
                      - verification_session_media
                  id:
                    type: string
                  url:
                    type: string
                    description: Signed URL, valid 5 minutes.
                  url_expires_at:
                    type: string
                    format: date-time
                  sha256:
                    type: string
                    description: Hash of the exact bytes the models scored.
                  content_type:
                    type: string
                  expires_at:
                    type:
                      - string
                      - 'null'
                    format: date-time
                    description: Retention expiry of the stored capture.
        '302':
          description: Redirect to the image bytes (when `redirect=true`).
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/MediaNotAvailable'
        '502':
          $ref: '#/components/responses/Upstream'
components:
  responses:
    Unauthorized:
      description: UNAUTHORIZED — missing, invalid, or revoked API key
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: UNAUTHORIZED
              message: Missing, invalid, or revoked API key
    MediaNotAvailable:
      description: MEDIA_NOT_AVAILABLE — storage off, retention passed, or erased
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: MEDIA_NOT_AVAILABLE
              message: No stored capture for this verification session
    Upstream:
      description: UPSTREAM_ERROR — inference service unavailable; retry with backoff
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: UPSTREAM_ERROR
              message: Inference service unavailable
  schemas:
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      description: >-
        Your secret key (sk_live_…), server-side only. Also accepted as an
        `x-api-key` header.

````