502 attachment_fetch_failed: a 5xx that is really your image URL

502 attachment_fetch_failed on a Sume Format run means Sume could not fetch the image URL you sent: the host was unreachable, the host blocks hotlinking, or it answered with a non-2xx status. Despite the 5xx status it is your input, so retrying the same URL does not help. Make the URL publicly reachable, then resend.

This follows the Formats and Format API errors docs, read 2026-09-29.

Why does a 502 mean my input is wrong?

Because Sume is the one fetching. The create call takes image URLs in attachments[], and Sume downloads them before the run starts. A 502 is the status for a failed upstream fetch, but the error carries next_action: fix_input, and the errors page says so in as many words: despite the 5xx, it is your input. details.index names the attachment that failed, so a run with several images tells you which one to fix.

Which attachment errors can the create call return?

How do I check the URL before I send it?

Fetch it the way a stranger would, from outside your network and without your cookies. The docs say image_url must be a public HTTPS URL that is reachable without auth, because Sume fetches it when you create the run. An image behind a login, or on a host with hotlink protection, fails this test. The HTTPS requirement is enforced by invalid_attachment, which covers a missing or non-HTTPS URL.

url="https://cdn.example.com/images/packshot.png"
code=$(curl -sS -L -o /dev/null -w "%{http_code}" "$url")
echo "$url -> $code"
[ "$code" = "200" ] || echo "Sume would see this as a failed fetch"

What if I cannot make the image public?

Host a copy where Sume can reach it without auth, for example a public object-storage URL, and send that as image_url. A URL already on media.sume.com, such as the output of an earlier Sume job, is not re-copied. An attachment carries image_url or asset_id, never both, and an unknown asset_id is 400 attachment_not_found. Idempotency covers attachments too: replaying a key with a different image list is 409 idempotency_conflict, and a true replay does not re-fetch your images.

Does the job API have the same error?

It has a sibling. For generation jobs, the errors page lists image_not_fetchable and input_media_unreachable as cases where Sume could not fetch or mirror media safely. The advice is the same: check that input media is a public HTTPS image URL, then retry or contact support with the request id.