server: expose thumbnail api