Store a portal design picture

The stored picture with its address.

Every write needs an Idempotency-Key header. Send a fresh UUID per distinct operation.

The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).

The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description. On this endpoint: TOKEN_MISSING_ABILITY: when the token lacks project:update, or its owner's role on the project's team may not change the project.

An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred. On this endpoint: RESOURCE_NOT_FOUND: when slot is not gallery, avatar or card.

The key was already used in the last 24 hours with a different request body.

The payload broke a rule, and error.fields maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with error.message saying why and no fields. On this endpoint: VALIDATION_FAILED: when image is missing, not a JPG, PNG, GIF or WEBP picture, or over 5 MB.

The first request with this key is still running; retry in a few seconds and the original response is replayed.

The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.