Can't load issuetype icon for avatar

Hi, I am using the atlaskit Avatar component in my custom UI app and I am trying to display the issuetype icon for an issue. I have received the icon url via the api in the form of /secure/viewavatar?size=medium&avatarId=10316&avatarType=issuetype and tried to make that the src property of the Avatar component but the icon will just display as the default shipping container icon which I am guessing means icon not found?
I have then tried to prepend atlassian.net and baseUrl.atlassian.net as received by the Server Info api. I have also added

external:
    images:
      - '*.atlassian.net/secure/*'

under permissions to my manifest. but still when I open the forge app tunnel and try to access my app I will get

CSP violation detected for 'img-src' while serving content at http://localhost:8002/
For an app to share data with external resources or use custom CSP, follow the steps in: https://go.atlassian.com/forge-content-security-and-egress-controls

entering my icon url in the browser I get the correct image in both cases. What am I doing wrong?

Hey @MichaelIlewicz ! Thanks for your question!

Currently, the Avatar component only accepts absolute URL’s and/or relative paths within your app to resources. As of this time of writing, there is no officially exposed URL available for consumption to be used that is safe and deterministic to use. We do however expose the icons through another @atlaskit/icon package which may be of use. See Atlaskit Icons for use.

You could also make use of the children prop in the Avatar component to create a custom Avatar component as well if you are using a Custom UI app.

Alternatively, you can download the specific svg of the icon you were after for use within your application from here via a relative path in your app directory. It is not recommended however to use the link as a URL reference as there is no guarantee it won’t change.

I have passed this on to the Design Team who indicated that they have had requests like this in the past, and that they may indeed put the icons on CDN’s for public use.

Hope this helps and if there are any follow up questions please reach out!

Hi Matthew,
thanks for your response. My URL is determined dynamically via the issue picker suggestions API which means that it is not a problem if the reference will change. However, that also makes a custom Avatar component or components from the Atlaskit difficult to use since users may have uploaded their own icons. I thought this would be more a matter of configuring permissions correctly? Using the Server Info API I am able to provide the full URL to the link. Do I maybe need to set a specific meta tag in my index.html for the app?