Skip to main content

Upload the organization logo

POST 
/api/v1/orgs/:org/logo

Stores an uploaded image as the organization's logo and points logoUrl at its public URL. Owner only.

Accepted content types are image/png, image/jpeg, image/webp, image/gif and image/svg+xml, up to 1 MB. Anything else is a 422 VALIDATION_ERROR; an oversized body is a 413.

The content type is the one the client declares in the multipart part header — the bytes are never sniffed or checked against it. The declared value is clamped to the allowlist and is what gets stored and echoed back as Content-Type, so an SVG uploaded as image/png is stored and served as image/png. The serving rules below never assume the type is harmless, which is what makes that safe.

The resulting URL (/pub/org-logos/{fileUid}) is unsigned and stable, but authorized by state: it only serves a file that is the CURRENT logo of a live organization, so replacing or clearing the logo un-publishes the previous image immediately. Uploaded SVGs are always served with Content-Disposition: attachment and X-Content-Type-Options: nosniff so they cannot execute as a document on the application's origin; they still render normally in an img element.

Request​

Responses​

Updated organization profile