对有大小限制的 Base64 输出进行本地解码。如果响应包含 URL，应将其记录并交给具备明确出站/Host 规则和重定向复核的获批下载器，而不是在 API 进程中直接访问。
shell
curl --fail-with-body https://www.getapi.one/v1/images/generations \
-H "Authorization: Bearer $GETAPI_ONE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "<IMAGE_MODEL_ID_FROM_CURRENT_CATALOG>",
"prompt": "A clean product diagram of a secure server-side API flow",
"n": 1
}' > image-response.json
检查 data[0] 并保存返回字节
import base64
import json
from pathlib import Path
from urllib.parse import urlsplit
payload = json.loads(Path("image-response.json").read_text(encoding="utf-8"))
item = payload["data"][0]
if item.get("b64_json"):
image_bytes = base64.b64decode(item["b64_json"], validate=True)
if len(image_bytes) > 25 * 1024 * 1024:
raise ValueError("Image exceeds the local 25 MB safety limit")
Path("generated-image.bin").write_bytes(image_bytes)
elif item.get("url"):
url = item["url"]
parsed = urlsplit(url)
if parsed.scheme != "https" or not parsed.hostname:
raise ValueError("Refusing an invalid or non-HTTPS image URL")
# Do not dereference provider-controlled URLs from a generic server example.
# Give this record to an approved downloader that enforces your egress and
# host policy, rejects private/link-local/loopback destinations, revalidates
# every redirect, sends no ONE credential, and bounds the response bytes.
Path("generated-image-url.txt").write_text(url, encoding="utf-8")
print("URL recorded for an egress-controlled downloader")
else:
raise ValueError("Expected data[0].url or data[0].b64_json")
GetAPI