1. Docs
  2. API Reference
  3. Upload profile avatar

Upload profile avatar

POST/v1/auth/me/avatar

Sets the signed-in administrator's profile picture from a multipart file field and returns the updated profile. Only JPEG, PNG and WebP are accepted, up to 5 MB and 6000 pixels on a side. The image is re-encoded as a 512x512 WebP with all metadata stripped, stored in private object storage, and any previous avatar is deleted. Refuses a missing, unsupported or undecodable file with 400 (avatar.invalid_image) and a body over 5 MB with 413. Limited to 6 uploads a minute.

Request body

multipart/form-data

filestring · binary Optional

Responses

application/json

  • dataAuthProfileDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Rate limit

6 requests per 1mPer caller: the signed-in user for a bearer token; for an API key, the key and the end user's address when a backend forwards it, otherwise the client address

Returned object

AuthProfileDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/v1/auth/me/avatar" \
  -H "Content-Type: application/json" \
  -d '{
    "file": "<binary>"
  }'
Response
{
  "data": {
    "id": "string",
    "email": "string",
    "first_name": "string",
    "last_name": "string",
    "avatar_url": "string",
    "pending_email": "string",
    "email_verified": false,
    "created_at": "2026-04-20T12:00:00.000Z",
    "account_role": "owner"
  }
}
 Related endpoints
POSTRegister a new user
POSTCreate an additional Account for the authenticated admin (no new user)
GETReview the parked account-creation intent before resuming
POSTResume a deferred account creation parked at the register form
DELETEDismiss the parked account-creation intent without creating anything
POSTLook up invite details by token
POSTAccept an invite
POSTAuthenticate and receive tokens
POSTSelect an Account from a pre-auth session (multi-Account login)
POSTSwitch the active Application in an authenticated session
POSTRefresh access token
POSTLogout and revoke tokens
GETVerify email address
POSTResend verification email
POSTResend verification email by token
POSTRequest password reset
POSTReset password with token
POSTChange password (authenticated)
GETGet current user profile
GETGet current user avatar image
DELETERemove profile avatar
POSTRequest an email-address change
POSTConfirm an email-address change
GETGet current user permissions
GETList the Accounts the current user belongs to
GETList active sessions
DELETERevoke all sessions
DELETERevoke a specific session
 Was this page helpful?

Tell us how we can improve this guide.

Canopy