Content type unacceptable. Content type "json" required

[LudovicRousseau]

Lychee version

v7.3.1

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.4

Detailed description of the problem

I would like to get a random image from my photo gallery.
I found Photo::random in https://demo.lycheeorg.dev/docs/api#/operations/frame.random
I was expecting to find it in Photo and not Frame part of the documentation.

The sample code for cURL is:

curl --request GET \
  --url https://demo.lycheeorg.dev/api/v2/Photo::random \
  --header 'Accept: application/json'

But I get:

$ curl --request GET   --url https://demo.lycheeorg.dev/api/v2/Photo::random   --header 'Accept: application/json'
{
    "message": "Content type unacceptable. Content type \"json\" required",
    "exception": "UnexpectedContentType"
}

I also tried the sample code for wget:

wget --quiet \
  --method GET \
  --header 'Accept: application/json' \
  --output-document \
  - https://demo.lycheeorg.dev/api/v2/Photo::random

I get no error but no output:

$ wget --quiet   --method GET   --header 'Accept: application/json'   --output-document   - https://demo.lycheeorg.dev/api/v2/Photo::random
$ echo $?
8

Without --quiet I get:

$ wget  --method GET   --header 'Accept: application/json'   --output-document   - https://demo.lycheeorg.dev/api/v2/Photo::random
--2026-01-28 16:40:44--  https://demo.lycheeorg.dev/api/v2/Photo::random
Résolution de demo.lycheeorg.dev (demo.lycheeorg.dev)… 135.125.237.145
Connexion à demo.lycheeorg.dev (demo.lycheeorg.dev)|135.125.237.145|:443… connecté.
requête HTTP transmise, en attente de la réponse… 406 Not Acceptable
2026-01-28 16:40:44 erreur 406 : Not Acceptable.

Steps to reproduce the issue

See above.

Diagnostics [REQUIRED]

not applicable

Browser & System [REQUIRED]

curl or wget

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.
• I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.

[ildyria]

It is expecting both the Accept and the content-type:

curl --request GET \
  --url https://demo.lycheeorg.dev/api/v2/Photo::random \
  --header 'Accept: application/json' \
  --header 'Content-type: application/json'

The double header is a result of the strictness of @nagmat84 :)

When I do it I get:

{
    "message": "Session expired",
    "exception": "SessionExpiredException"
}

The scrictness can be disabled by setting in your .env

REQUIRE_CONTENT_TYPE_ENABLED=false

I am looking into the Session expired issue.

[ildyria]

#4040

[LudovicRousseau]

I upgrade to v7.3.2. I also added the missing --header 'Content-type: application/json' argument. I suggest to update the generated documentation for https://xxxxxx/docs/api#/operations/frame.random
I note the documentation for https://demo.lycheeorg.dev/docs/api#/operations/auth.login already contains the 2 --header arguments.

I now have:

curl --request GET   --url https://images.xxxxx.yyyy/Lychee/api/v2/Photo::random   --header 'Accept: application/json' --header 'Content-type: application/json'
{
    "message": "User is not authenticated",
    "exception": "UnauthenticatedException"
}

Why not return an image that is publicly available?

[ildyria]

I upgrade to v7.3.2. I also added the missing --header 'Content-type: application/json' argument. I suggest to update the generated documentation for xxxxxx/docs/api#/operations/frame.random

I looked into it and the documentation is using https://scramble.dedoc.co/
I tried to get it to also add the extra header using https://scramble.dedoc.co/developers/customize-openapi-documents , but it didn't work. :(

I note the documentation for demo.lycheeorg.dev/docs/api#/operations/auth.login already contains the 2 --header arguments.

Interesting, it seems that this is because it is a GET query that it refuses to add the header in the documentation, as it assumes that GET are not receiving data.

Why not return an image that is publicly available?

If album is specified as null here: https://github.com/LycheeOrg/Lychee/blob/master/app/Http/Requests/Frame/FrameRequest.php#L54
then it should be random.

Can you check the value of random_album_id in your settings?
"Album id to be used by for random function." in https://lychee.example.com/settings/Mod%20Frame
If you make this field empty. You should get publically accessible pictures.

[LudovicRousseau]

If I add the album_id parameter I get a correct answer. Cool!
Now I need to get the list of album_id.

From https://xxx/Lychee/diagnostics I have

[...]
random_album_id:                           starred
[...]
enable_starred:                            1
[...]

From https://xxx/Lychee/gallery/starred I have starred pictures, not albums.

I tried to get the list of public albums but with no success:

curl --request GET   --url https://xxx/Lychee/api/v2/Album::getTargetListAlbums   --header 'Accept: application/json' --header 'Content-type: application/json'
{
    "message": "Session expired",
    "exception": "SessionExpiredException"
}

[ildyria]

Humm I don't think we have an endpoint that give the list of ALL PUBLIC albums.

[ildyria]

I can see to add such end point.

[LudovicRousseau]

If /api/v2/Photo::random can return a photo from any public album (without a album_id parameter) that is also fine for me.

[ildyria]

If you set random_album_id in your configs table to empty string (or via the settings page in Mod Frame) then it should be doing so yes.

[LudovicRousseau]

Exact. With an empty "ID de l’album utilisé pour la fonction aléatoire." it works as I expect.
Thanks

[LudovicRousseau]

What are the impacts of using: REQUIRE_CONTENT_TYPE_ENABLED=false?
From the .env file I see:

# All API requests to have the header "content-type: application/json"
# or "content-type: multipart/form-data" depending on the type.
#
# If you want to disable this requirement, set this to false.
#
# This requirement prevents the use of the API from the API documentation page.

The only goal is to prevent the use of the API from the documentation page? But why would I want that?

I ask because with REQUIRE_CONTENT_TYPE_ENABLED=true I have to:

1. explicitly add the header in the request:

            const url = 'https://xxxx/Lychee/api/v2/Photo::random';
            const options = {
                method: 'GET',
                headers: new Headers({
                    Accept: 'application/json',
                    "Content-Type": "application/json",
                })
            };

            try {
              const response = await fetch(url, options);
              const data = await response.json();
       [...]

2. explicitly allow the header in the apache web server config:

  Header set Access-Control-Allow-Headers "Content-Type"

It is a lot of pain, just for a documentation "issue".
But maybe I am missing something?

[ildyria]

It is more a question about standards. As a lot of our GET request are specifying some JSON data on the side and not using query parameters, technically they should provide the Content-Type header.

It is not per say bad if you disable it. There is no security risk AFAIK it is more of a strictness with regard to HTTP standards.

[LudovicRousseau]

OK. So I will keep it disabled.

What is not clear to me is: why do I have to change my apache configuration to allow the "Content-Type" header so that the JavaScript request can work, while it is not needed for curl or wget.

In the apache configuration I also had to use Header set Access-Control-Allow-Origin "https://xxx" for Cross-Origin Resource Sharing to make my JavaScript request to work. But that I can understand.

[ildyria]

What is not clear to me is: why do I have to change my apache configuration to allow the "Content-Type" header so that the JavaScript request can work, while it is not needed for curl or wget.

In the apache configuration I also had to use Header set Access-Control-Allow-Origin "https://xxx" for Cross-Origin Resource Sharing to make my JavaScript request to work. But that I can understand.

Honestly no clue on that one. :/ I did not had to do this on my side.

You mean in the .htaccess?

# ---
# Uncomment these lines when you want to allow access to the Lychee API from different origins
# ---
#Header add Access-Control-Allow-Origin "*"
#Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
#Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

[LudovicRousseau]

I had not thought of using the .htaccess file.
I modified /etc/apache2/sites-enabled/xxxx.conf

I now moved my modification in the public/.htaccess file. Thanks for the idea.