Operation
Upload the customer's photo
PUT
/customers/{customerId}/photoUpload a photo (multipart/form-data, field "file"; JPEG, PNG or WebP, at most 5 MB) to the customer's record, replacing any photo it had, which is deleted. Stored privately and erased when the customer is deleted. Needs customers.update too. The customer's photo is the restricted tier of their record: reading or changing it needs customers.read_restricted on the customer's account, held by Organisation Owner, Platform Admin and Venue Admin, and by any role an organisation grants it to.
Path parameters
customerIdstringRequired- Customer ID
Headers
Idempotency-KeystringOptional- Makes the write safe to retry. The first request with a key does the work and its response is stored for 24 hours; a repeat with the same key and the same request (method, path, query, X-Ticketlayer-Channel, TL-Version and body) gets that stored status and body back, marked `Idempotent-Replay: true`, without running again. The key is scoped to your organisation and your credential. The same key with a different request is 422 IDEMPOTENCY_KEY_REUSED; a repeat while the first is still running waits for it, then answers 409 IDEMPOTENT_REQUEST_IN_PROGRESS if it has not finished. Only a 2xx is stored: after an error the key is free again. Omit the header and the request behaves as it always has.
Returns
Stored
Errors
- 400
- Bad Request - Invalid input
- 401
- Unauthorized - Authentication required
- 403
- Forbidden - Insufficient permissions
- 404
- Not Found - Resource not found
- 500
- Internal Server Error
Every error names its code and links to it. All error codes
curl -X PUT "https://api.ticketlayer.com/v1/customers/cus_abc123/photo" \ -H "Authorization: Bearer tlak_..." \ -H "X-Ticketlayer-Org: your-org-slug"Response 201
{
"photo": {
"assetId": "string",
"contentType": "image/jpeg",
"sizeBytes": 0,
"url": "string",
"expiresAt": "string",
"uploadedAt": "string",
"uploadedBy": "string"
}
}