---
title: "Upload one image for a post"
method: POST
path: "/posts/{id}/images"
tags: ["Authoring"]
---

# Upload one image for a post

`POST /posts/{id}/images`

## Request

- Base URL: `https://api.sweetvaluelab.com`
- URL: `https://api.sweetvaluelab.com/posts/{id}/images`
- Auth: HTTP bearer

The response's `path` (`/blog/img/<hash>.<ext>`) is what the body's `![alt](path)` or the frontmatter's `hero` uses. Content-addressed: the same bytes uploaded twice are one image, and the second call answers `deduplicated: true`. PNG, JPEG, WebP or SVG (an SVG containing a script, an event handler or a `javascript:` URL is refused); a `hero` must be a raster image. At most 2 MB per image and 20 images per post.

## Request body

- object
  - `data` string, required: The image as base64, or as a data: URL.
  - `contentType` 'image/png' | 'image/jpeg' | 'image/webp' | 'image/svg+xml', required

## Other responses

- `400`: `bad_request`: an unsupported type, an empty or unreadable body, or an SVG with active content.
- `401`: No credential, or a token that is unknown, revoked or expired. The response carries `WWW-Authenticate: Bearer realm="sweetvaluelab"`; `error.code` is `unauthenticated`.
- `404`: `not_found`: no post with that id on this account.
- `413`: `too_large`: the image is over 2 MB.
- `429`: `quota_exceeded`: the post already carries 20 images.

---

[API](https://skmtc.dev/sweetvaluelab/apis/sweetvaluelab-api.md) · [All operations](https://skmtc.dev/sweetvaluelab/apis/sweetvaluelab-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sweetvaluelab/apis/sweetvaluelab-api/revisions/6990fff94d5e?raw)