Issue Nº 32 — Sep 13, 2026
DiceBear ignores a bad option name and rejects a bad option value
Issue thirty-two covers DiceBear, a keyless avatar API. This session queried it live. A wrong query key gets silently dropped. A wrong query value gets a 400. Leaving the seed out does not add randomness, and the generated PNG carries its own credit line inside the file.
A bad key is dropped, a bad value is rejected
GET /10.x/bottts/svg?seed=greatapis¬ARealOption=42, queried live this session, returned the same 3,757-byte body as the call with no extra parameter at all. The unknown key was ignored.
GET /10.x/bottts/svg?seed=greatapis&size=99999, queried live this session, returned 400 with a Fastify validation error: querystring/size must be <= 4096. A bad backgroundColor value returned the same 400 shape, with the message spelling out the hex pattern it expects.
A caller who mistypes a parameter name gets no warning. A caller who mistypes a parameter value gets an explicit error. Only one of those two typos will ever reach a bug tracker.
No seed does not mean a random avatar
Three calls to GET /10.x/bottts/svg with no seed and a different cache-busting parameter each time, queried live this session, returned three byte-identical bodies.
A successful response carries cache-control: public, max-age=31919000, about 369 days. A 400 response carries max-age=5. A caller who skips the seed parameter gets the same fixed avatar for every user, and that avatar sits in every CDN cache for a year.
Requesting an older major version still works: GET /7.x/bottts/svg?seed=x, queried live this session, returned 200. DiceBear keeps old API versions live alongside the current one.
The PNG carries its own attribution
GET /10.x/bottts/png?seed=greatapis, queried live this session, returned a 5,954-byte PNG with an embedded IPTC block naming the style, Bottts, and the artist, Pablo Stanley, plus the licence terms.
The SVG format embeds the same credit as an RDF metadata block instead of an IPTC block. GET /10.x/bottts/json?seed=greatapis returns the SVG markup wrapped in a JSON string under an svg key, not a data URI, so a caller expecting a data URI has to build one itself.
Stripping metadata before storing or serving these avatars removes that credit. DiceBear's licence is Free for personal and commercial use, and the file carries the proof.
Dicebear Avatars, by the numbers
50 requests/second (SVG), 10 requests/second (PNG, JPG, WebP, AVIF)
- GET/{style}/svg
- GET/{style}/png