---
title: "Upload BIMI assets"
method: POST
path: "/domains/{id}/bimi/assets"
tags: ["Domain"]
---

# Upload BIMI assets

`POST /domains/{id}/bimi/assets`

## Request

- Base URL: `https://api.palisade.email`
- URL: `https://api.palisade.email/domains/{id}/bimi/assets`
- Auth: one of:
  - HTTP bearer
  - HTTP basic

Ingests a Verified Mark Certificate (VMC), extracts and verifies the logotype SVG embedded in the certificate, and hosts the matched certificate + logo pair at per-domain asset URLs with a short content-derived version suffix ({domain}/bimi/logo-{v}.svg and {domain}/bimi/certchain-{v}.pem). Re-posting the same PEM returns the same URLs; a new PEM gets fresh URLs so caches never serve stale assets.

## Path parameters

- `id` string, uuid, required

## Headers

- `Palisade-Version` '2025-04-30' | 'unstable', required

## Request body

- IngestBimiAssetsBody
  - `certificate_pem` string: The VMC as a PEM string. Alternative to the multipart certificate file part.
  - `certificate_url` string, uri: An https URL to fetch the VMC PEM from. Alternative to the multipart certificate file part.

## Response `200`

Success

- BimiAssetsResponse
  - `certificate_url` string, uri, required
  - `logo_url` string, uri, required
  - `logotype_verified` boolean, required: The SVG hosted at logo_url was recovered from the certificate's logotype extension and matches the digest the certificate asserts. This covers the logo only — it says nothing about whether the certificate chain validates. Read chain_verified for that.
  - `svg_profile` 'tiny-ps', required
  - `chain_verified` boolean, required: The hosted certificate chain was verified end to end: every signature checks out, no certificate in the path is expired, and the path terminates in a pinned BIMI trust anchor. Uploads that cannot reach this state are rejected, so a 200 response always carries true.
  - `chain_length` integer, required: How many certificates the hosted chain contains, counting the VMC leaf, intermediates and root.
  - `chain_repaired` boolean, required: True when the uploaded PEM was missing certificates and Palisade completed the chain (fetching the intermediate from the certificate's Authority Information Access endpoint and appending the pinned root) before hosting it. The hosted chain, not the uploaded one, is what certificate_url serves.
  - `trust_anchor` string, required: Common name of the pinned VMC root the hosted chain terminates in.
  - `san_verified` boolean, required: The leaf certificate's subjectAltName covers the domain the assets were attached to.
  - `not_after` string, date-time, required: When the VMC leaf expires. VMCs are one-year certificates, so this is worth tracking.
  - `warnings` string[], required: Non-fatal observations about the certificate. "vmc-mark-type-oid-missing" means the leaf does not carry the VMC mark-type OIDs under 1.3.6.1.4.1.53087, which is certificate-authority dependent and does not block hosting.
  - `cert` object, required
    - `serial` string, required
    - `not_after` string, date-time, required
    - `common_name` string, nullable, required

## Other responses

- `422`: Certificate rejected

---

[API](https://skmtc.dev/palisade/apis/palisade-api.md) · [All operations](https://skmtc.dev/palisade/apis/palisade-api/llms.txt) · [OpenAPI document](https://skmtc.dev/palisade/apis/palisade-api/revisions/37b4ae5a7766?raw)