# Get Hosted Asset

> Hosted BIMI logo / certificate

**Endpoint:** `GET /bimi/{domain}/{file}`  
**Access:** Public (no credentials needed)

Also served host-based at https://bimi.getverifiedinbox.com/{domain}/{file}. 404 until active.

## cURL example

```bash
curl "https://api.verifiedinbox.ai/bimi/acme.com/logo.svg"
```

## Parameters

| Parameter | Type | Description |
|---|---|---|
| `domain` (path, required) | `string` | Customer domain, e.g. `acme.com`. |
| `file` (path, required) | `string` | `logo.svg` or `certificate.pem` (`vmc.pem`/`cmc.pem` are accepted aliases). |

## Responses

### 200 OK

`logo.svg` (SVG) or `certificate.pem` (`application/x-pem-file`).

### 400 (invalid_request)

`invalid_request` — the request is malformed.

```json
{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}
```

### 404 (not_found)

`not_found` — doesn't exist or isn't accessible to you (never 403).

```json
{
  "error": {
    "code": "not_found",
    "message": "We couldn't find that resource."
  }
}
```

### 429 (rate_limited)

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
```