Internal HTTP API (unsupported)

The embedded viewer uses local HTTP routes as a private implementation protocol. They are not a supported public interface, are not covered by compatibility guarantees, and may change with any dcmview release.

Do not build third-party integrations against these routes. Supported user interfaces are listed in the Reference overview.

Sensitive-data surface

Every request under /api requires Authorization: Bearer <token>. Anyone who has the session’s token and can reach the listener can retrieve decoded pixels, DICOM metadata, local paths, identifiers, references, and in-memory annotations. The token does not encrypt plain HTTP. Keep the normal viewer on loopback and use SSH forwarding for remote work.

Requests need the access token

Since v0.4.0, a request without a valid token gets 401 with WWW-Authenticate: Bearer and this body, on every API path:

{
  "code": "unauthorized",
  "error": "missing or invalid access token: send Authorization: Bearer <token>"
}

The token is accepted in the Authorization header only, not in a query parameter or cookie. A script reads it, together with the address to call, from the server_started line that dcmview --no-browser --startup-json prints: use base_url and token, and never append an API path after the #token=… fragment of url. DCMVIEW_TOKEN fixes the token, and --no-token turns the check off for a listener behind a proxy that already authenticates.

This URL is retained so existing documentation and bookmarks do not break. Source maintainers who need the script example, startup fields, endpoint, response, cache-header, error-envelope, or cross-origin debugging details should use the internal HTTP protocol documentation.