Uploads a banner or product image.
POST
/api/hostedpaymentpages/images/upload
deprecated
Requires: HostedPaymentPage.HostedPaymentPages.Update, merchant scope.
Returns the generated blob filename plus its CDN preview URL. Accepts multipart/form-data (max 2 MB, max 4000x4000 pixels; gif, jpg, jpeg, png, or webp). The stored filename is server-generated; place the returned `blobName` in a page's `bannerImage` or `productImageBlobName`. Invalid uploads return a field-attributed 400 validation error.
Signed in, you can send this request to your own sandbox merchant from the console and read the answer. Sign in to try it.
Example request
Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.
The request body is a . See the Request body section below for its fields.
Parameters
Request body
multipart/form-data
, required
| Field | Type | Description |
|---|---|---|
File
required |
string (binary) | The uploaded image content. The multipart filename is used only to read the claimed extension
for the magic-byte cross-check; it never becomes the stored name. Required: the endpoint rejects a
missing file with a field-attributed validation error.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
ExtraProperties
required |
object |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This request body has no documented fields.
Responses
200 OK
Body:
HppImageUploadResultDto
HppImageUploadResultDto
Each item has these fields.
| Field | Type | Description |
|---|---|---|
blobName
required |
string | The server-generated blob filename (`{guid}.{ext}`). Passes the `HppImageBlobName` validator;
assign it to `bannerImage` or `productImageBlobName` on a page create / update.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
previewUrl
required |
string | The resolved CDN URL at which the stored image renders (`{cdn}/hosted-page-imgs/host/{blobName}`).
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
contentType
required |
string | The image MIME type derived from the verified magic bytes and stored on the blob.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
width
required |
integer (int32) | The decoded image width in pixels.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
height
required |
integer (int32) | The decoded image height in pixels.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
sizeBytes
required |
integer (int64) | The stored byte size of the image.
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
400 Bad Request
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo RemoteServiceErrorInfo |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
403 Forbidden
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo RemoteServiceErrorInfo |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
401 Unauthorized
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo RemoteServiceErrorInfo |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
404 Not Found
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo RemoteServiceErrorInfo |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
501 Not Implemented
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo RemoteServiceErrorInfo |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
500 Internal Server Error
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo RemoteServiceErrorInfo |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
default The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take. The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take.
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo RemoteServiceErrorInfo |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
429 The request was refused because a rate limit was exceeded, or because something a later retry can clear stopped it. A rate limit refusal carries an `application/problem+json` body: wait at least the interval `Retry-After` names before retrying, then back off. Limits are tuned per deployment, so read the allowance from the response headers rather than assuming a fixed ceiling. Any other refusal carries the standard error envelope as `application/json`, and its `error.code` names the cause.
Body:
RemoteServiceErrorResponse
RemoteServiceErrorResponse
Each item has these fields.
| Field | Type | Description |
|---|---|---|
error
required |
RemoteServiceErrorInfo RemoteServiceErrorInfo |
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This response has no documented body fields.
Errors
A failed request returns the platform error envelope. The
error reference lists every value
error.code can carry and shows the four response shapes.