---
title: "Persist a new avatar order for the current user."
method: POST
path: "/api/v1/avatars/reorder"
tags: ["Avatars"]
---
# Persist a new avatar order for the current user.
`POST /api/v1/avatars/reorder`
## Request
- Base URL: `https://api.avatarfactory.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.avatarfactory.io/api/v1/avatars/reorder`
- Auth: one of:
- API key in cookie `session`
- HTTP bearer
The SPA sends the caller's avatars in their new order; each owned row's
``display_order`` is set to its position in that list, in a single
transaction. Ids the caller does not own (or that don't exist) are
skipped, so a stale or malicious client can never reorder another
user's rows. The default list sort (``custom``) reads ``display_order``
ascending, so this is exactly the order the grid renders next load.
Returns the owned ids that were reordered, in their new order.
## Request body
- ReorderAvatarsRequest: Payload for ``POST /api/v1/avatars/reorder``. ``ids`` is the caller's avatars in their new left-to-right / top-to- bottom order. The endpoint writes ``display_order`` = position in this list for every id the caller actually owns; unknown or foreign ids are silently skipped so a stale client can never reorder another user's rows. Unknown fields are rejected so the SPA can't drift the contract.
- `ids` integer[], required
## Response `200`
OK
- ReorderAvatarsResponse: The persisted order after a reorder. ``ids`` echoes only the owned avatars that were reordered, in their new order, so the SPA can confirm which rows the write actually touched.
- `ids` integer[], required
- `success` boolean, required
## Other responses
- `401`: Unauthorized
- `422`: Unprocessable Entity
---
[API](https://skmtc.dev/avatarfactory/apis/avatarfactory-api.md) · [All operations](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/llms.txt) · [OpenAPI document](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/revisions/66fc7aa3f296?raw)