Avatar Management

Upload, retrieve, and delete user profile images.

GET /api/users/{username}/avatar

Get the user's cropped avatar image.

Authentication: Required (publicly accessible endpoint)

Path Parameters:

Parameter	Type	Description
username	string	Username

Query Parameters:

Parameter	Type	Description
t	integer	Timestamp for cache busting

Response:

Returns the avatar image bytes (not JSON). Falls back to the generated initials avatar when none is set.

Content-Type: image/png, image/jpeg, etc.

---

GET /api/users/{username}/avatar-full

Get the user's original (uncropped) avatar image.

Authentication: Required

Response:

Returns the original uploaded image bytes without resizing.

---

PUT /api/users/{username}/avatar

Set a user's avatar.

Authentication: Required

Permissions: User can update own avatar; admins can update any user's avatar

Path Parameters:

Parameter	Type	Description
username	string	Username

Request Body:

Field	Type	Required	Description
cropped	string	Yes	The already-cropped image as a base64 PNG data URL (data:image/png;base64,...)

The raw image bytes are stored, not returned.

Set a user avatarPUT /api/users/annie.larson/avatar

The cropped field is a base64-encoded PNG data URL of the already-cropped image. The raw image bytes are stored, not returned.

Request body

{
  "cropped": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M8AAAMBAQDJ/pLvAAAAAElFTkSuQmCC"
}

Response · 200

{
  "_links": {
    "self": {
      "href": "https://informer.example.com/api/users/annie.larson/avatar"
    }
  },
  "id": "00000000-0000-4000-8000-000000000001",
  "tenant": "acme",
  "userId": "annie.larson",
  "cropped": "(omitted)",
  "updatedAt": "2026-01-15T16:20:00.000Z",
  "createdAt": "2026-01-15T16:20:00.000Z",
  "original": "(omitted)",
  "contentType": null,
  "_altid": null
}

Captured from the API examples test suite; ids and timestamps are normalized.

---

DELETE /api/users/{username}/avatar

Remove the user's avatar.

Authentication: Required

Permissions: User can delete own avatar; admins can delete any user's avatar

Path Parameters:

Parameter	Type	Description
username	string	Username

Response:

Responds 200 on success. Subsequent avatar reads fall back to the generated initials avatar.

Remove a user avatarDELETE /api/users/annie.larson/avatar

Deletes the stored avatar; subsequent avatar reads fall back to the generated initials avatar.

Response · 200 · no body

Captured from the API examples test suite; ids and timestamps are normalized.

---

POST /api/users/{username}/_upload/{uploadId}/avatar-upload

Upload an avatar via the chunked upload flow (for large or resumable uploads).

Authentication: Required

Path Parameters:

Parameter	Type	Description
username	string	Username
uploadId	string	Upload session ID

Use Case:

For large avatar files or resumable uploads. See the upload API for the multipart chunk protocol.