Set the profile image
/account/profile-imageStores the image as the calling user's profile image, deletes the image it replaces unless another user or a branding setting still uses it, and returns the account. It cannot be undone through the API: the replaced file is deleted and cannot be restored. The file must be an image of at most 10 MiB, else 422; an SVG is refused. dry_run validates the file, stores nothing and returns the account unchanged, with the current image address. Sends no email and emits no webhook.
Query parameters
Validate and run the call without committing it, returning what the real call would return with
meta.dry_runset.
Headers
Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.
Request body
multipart/form-data, required
The image, at most 10 MiB.
Responses
{
"data": {
"id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
"name": "string",
"email": "string",
"username": "string",
"status": "string",
"user_type": "string",
"organisation": {
"id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
"name": "string"
},
"profile_image_url": "string",
"permissions": [
"string"
],
"created_at": "2026-06-12T10:00:00+00:00"
}
}Authorization failed. error.code is one of org_disabled,
ip_blocked, missing_scope, scope_disabled, user_disabled.
The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per
problem, or a code documented on the operation.
Examples
curl -X POST https://your-org-domain/kong/core/api/v2/account/profile-image\
-H "Authorization: Bearer $HELM_API_KEY"\
-H "Content-Type: application/json"