---
title: "Upload image"
method: PUT
path: "/v1/account/avatar"
tags: ["Account"]
---

# Upload image

`PUT /v1/account/avatar`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/account/avatar`
- Auth: HTTP bearer

Requires account.write. Raw PNG, JPEG, WEBP or GIF bytes, at most 1048576 bytes. Content-Type must match the signature. Account avatars do not require organization membership when organizationId is omitted. Replaces and deletes the old managed blob. No URL, multipart or JSON input is accepted. MCP upload_account_avatar and upload_organization_logo accept canonical base64 up to 524288 decoded bytes. Requires a user-delegated OAuth token. Organization API keys are refused. Enforced after scope and role authorization: rollout-agent-access-writes (default off) and allow-public-agent-writes (default on). Reads remain available when writes are paused.

## Query parameters

- `organizationId` string

## Request body `image/png`

- string, binary

## Response `200`

Upload image

- object
  - `success` true, required
  - `data` AccountProfile, required
    - `createdAt` string
    - `email` string, required: An email address.
    - `hidePII` boolean, required
    - `id` string, required
    - `image` string, nullable, required
    - `name` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `503`: The capability is temporarily paused by an operator. Retry later.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/account/avatar/put.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)