Skip to content
StraventaDocs
Now in Sandbox.

Upload a product image (multipart)

POST
/api/pos/v1/catalog/products/{id}/image

Story 5 AC-5.5. Multipart upload of a single image part named image. Request body is capped at 5 MiB via http.MaxBytesReader BEFORE the multipart parser runs; oversize bodies return 413 image_too_large. Accepted content types (closed set): image/png, image/jpeg, image/webp — anything else returns 415 unsupported_media_type. The client-supplied filename is sanitized via filepath.Base to prevent path traversal; the storage key is server-derived as products/<tenant_id>/<product_id>.<ext> so the client cannot influence object names. Persists the storage KEY in image_url on the product row in the same tenant tx (the response answers the absolute URL composed from POS_MEDIA_BASE_URL) and broadcasts a product.image_updated CatalogStreamEvent. Gated by pos.catalog.write.

Authorization

bearerAuth
AuthorizationBearer <token>

In: header

Path Parameters

id*string
Formatuuid

Request Body

multipart/form-data

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://sandbox.505pay.link/api/pos/v1/catalog/products/497f6eca-6276-4993-bfeb-53cbbbba6f08/image" \  -F image="string"
{
  "id": "018f4d9f-7b8a-7c2d-9a2d-1f8b92f6d101",
  "image_url": "https://s3.straventa.com/pos/products/018f4d9f-7b8a-7c2d-9a2d-1f8b92f6d000/018f4d9f-7b8a-7c2d-9a2d-1f8b92f6d101.png"
}
{
  "error": "string",
  "message": "string",
  "request_id": "string"
}
{
  "error": "string",
  "message": "string",
  "request_id": "string"
}
{
  "error": "string",
  "message": "string",
  "request_id": "string"
}
{
  "error": "string",
  "message": "string",
  "request_id": "string"
}
{
  "error": "string",
  "message": "string",
  "request_id": "string"
}
{
  "error": "string",
  "message": "string",
  "request_id": "string"
}
{
  "error": "rate_limit_exceeded",
  "message": "Too many requests to /v1/check",
  "request_id": "018f4d9f-7b8a-7c2d-9a2d-1f8b92f6ffff"
}
{
  "error": "string",
  "message": "string",
  "request_id": "string"
}

Was this page helpful?