Fetching profile picture in Salesforce can be done in many ways and one of the ways is to use Callout using Named Credentials and get the file as blob so that you can store it somewhere or pass it to other APIs.
Below is the sample code you can use to get the file but there is a problem with the below code as when you will make a callout to profilephoto/729bZ0334444Otd/T will give you 302 redirect status code and we generally refresh the token when receiving a 401 but as in this case we are getting 302 so the token will not be refreshed:
HttpRequest fetchRequest = new HttpRequest();
fetchRequest.setEndpoint('callout:SalesforceSelfEndpoint/' +'profilephoto/729bZ0334444Otd/T');
fetchRequest.setMethod('GET');
fetchRequest.setHeader('Accept', '*/*');
Http fetchHttp = new Http();
HttpResponse fetchResponse = fetchHttp.send(fetchRequest);
Blob fileContent = fetchResponse.getBodyAsBlob();
System.debug('Status: ' + fetchResponse.getStatusCode());
System.debug('Blob size: ' + (fileContent != null ? fileContent.size() : 0));
To resolve this issue, create an additional Named Credential that uses the same External Credential, then make a dummy call using the new Named Credential. This call will refresh the token and store it. Since both Named Credentials share the same External Credential, the original Named Credential that was returning the 302 code will now have the updated token. After this, when you make a callout to fetch the photo using the above code, it should work.
HttpRequest fetchRequest = new HttpRequest();
fetchRequest.setEndpoint('callout:Test200NamedCred/' + '/services/data/v56.0/actions/custom/flow/Dummy_Flow'');
fetchRequest.setMethod('POST');
fetchRequest.setHeader('Content-Type', 'application/json');
string body = '{ "inputs" : [ ] }';
fetchRequest.setBody(body);
Http fetchHttp = new Http();
HttpResponse fetchResponse = fetchHttp.send(fetchRequest);
004634379

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.