Upload Account Photo

Returns a signed, short-lived upload URL for the visitor's profile photo. Upload the file straight to it, then save the returned `publicUrl` with Update Visitor Account.

POST/v1/account/photo

Authentication

Public key + visitor?key=pk_… · Authorization: Bearer

Public key in the `key` query parameter, plus the signed-in visitor's access token as `Authorization: Bearer`.

Edge cache: no-store

Query Parameters

keystring

required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

contentTypeenum

required

MIME type of the photo.

image/jpegimage/pngimage/webp

fileSizenumber

required

Exact size of the file in bytes, a positive integer up to 5242880 (5 MB).

Responses

200Success

application/json

typestring

urlstring

publicUrlstring

headersobject

Errors

400Invalid body: unsupported `contentType`, `fileSize` missing or over 5 MB, or an unknown field.

401`Sign in required`: missing, expired or wrong-site access token.

503Photo uploads are not available on this site yet. The body is `{ type: "error", message }`.

403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

Upload with `PUT` to `url`, sending the `headers` from the response plus a `Content-Length` equal to `fileSize`, and the raw file as the body. The URL works for 5 minutes.
Then call `PATCH /v1/account` with `{ "image": publicUrl }`.

Request

curl --request POST \
  --url "https://api.pandaidx.com/v1/account/photo?key={{public_key}}" \
  --header "Authorization: Bearer {{visitor_token}}" \
  --header "Content-Type: application/json" \
  --data '{"contentType":"image/jpeg","fileSize":245760}'

Response200 OK

{
  "type": "success",
  "url": "https://uploads.example.com/app/example/avatar/photo.jpg?X-Amz-Signature=example",
  "publicUrl": "https://cdn.example.com/app/example/avatar/photo.jpg",
  "headers": {
    "Content-Type": "image/jpeg"
  }
}