# Upload an image asset

`POST /v1/assets`

- Authentication: required (Bearer token)
- Required scope: `api.assets.manage`

Uploads one image to the org's Edge CDN at a logical `path` — the string
templates reference as `{{asset "static/logo.png"}}` or as a relative
`src` attribute. Send either a `multipart/form-data` body with a `file`
part and a `path` field (the filename is used when `path` is omitted), or
a JSON body carrying the bytes as base64.

**Content-addressed, so re-running a push is free.** The object key is
the SHA-256 of the bytes, so uploading the same image at the same path
writes nothing and answers `200` with `unchanged: true`. Uploading
*different* bytes at the same path mints a new object and repoints the
path; the previous object is retained, so a template already deployed
against it keeps rendering the image it was deployed with.

**Uploading does not redeploy anything.** A deployed template embeds the
URL it was deployed against, so replacing an image leaves the templates
using it rendering the old one until they are deployed again.
`referenced_by` lists exactly those templates. For the same reason, a CI
push should upload images *before* writing templates.

The content type is decided by sniffing the bytes, never by the filename
or the supplied `content_type`: PNG, JPEG, GIF and WebP are accepted, and
anything else — including SVG, which can carry script and would be served
from your own CDN origin — is `422`. The image must be at most 5 MiB. An
org with no active Edge CDN has nowhere to host the bytes and gets
`409 edge_cdn_not_provisioned`.

## Request body

Content type: `multipart/form-data`

```json
{
  "file": "string",
  "path": "static/logo.png"
}
```

## Example request

```bash
curl -X POST 'https://api.sendops.dev/v1/assets' \
  -H "Authorization: Bearer $SENDOPS_API_KEY" \
  -H "Content-Type: multipart/form-data" \
  -d '{"file":"string","path":"static/logo.png"}'
```

## Responses

### 200 — The stored asset. `unchanged` is true when nothing was written.

Content type: `application/json`

```json
{
  "id": "00000000-0000-0000-0000-000000000000",
  "source_path": "string",
  "url": "string",
  "content_hash": "string",
  "content_type": "string",
  "size_bytes": 0,
  "width": 0,
  "height": 0,
  "created_at": "2026-05-17T20:00:00Z",
  "referenced_by": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "name": "string"
    }
  ],
  "tags": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "name": "string",
      "key": "string",
      "color": "string",
      "description": "string",
      "created_at": "2026-05-17T20:00:00Z",
      "updated_at": "2026-05-17T20:00:00Z"
    }
  ],
  "unchanged": true
}
```

### 401 — Missing, malformed, or unknown API key

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 403 — Key lacks the required scope or plan limit violated

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 409 — The mutation is rejected by a state rule rather than a bad request. The
`code` is `conflict`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 413 — A query parameter, path value or body field failed validation.

The body is a `validation_failed` Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries `validation_code`,
`field`, `line`/`column`, `missing`, `candidates` and `next_step`, so a
client can correct the call without a second round of guessing. See
`ValidationProblem`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ],
  "validation_code": "invalid_syntax",
  "field": "string",
  "line": 0,
  "column": 0,
  "missing": [
    {
      "kind": "segment",
      "key": "string"
    }
  ],
  "candidates": {},
  "next_step": "string"
}
```

### 422 — A query parameter, path value or body field failed validation.

The body is a `validation_failed` Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries `validation_code`,
`field`, `line`/`column`, `missing`, `candidates` and `next_step`, so a
client can correct the call without a second round of guessing. See
`ValidationProblem`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ],
  "validation_code": "invalid_syntax",
  "field": "string",
  "line": 0,
  "column": 0,
  "missing": [
    {
      "kind": "segment",
      "key": "string"
    }
  ],
  "candidates": {},
  "next_step": "string"
}
```

### 429 — Per-org rate limit exceeded

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 500 — Unexpected server-side failure. The `code` is `internal_error`. The
`request_id` field can be quoted to SendOps support to investigate.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```