/api/v1/products/{id}/imagesUpload a product image
Upload a single image file (multipart/form-data, field name file) and append it to the product's imageUrls array. Use this when you don't have a CDN URL ready — TracePass stores the image and returns its public URL in the response.
PNG / JPG / WebP only, max 5 MB per file, max 20 images per product. No Idempotency-Key support — multipart bodies aren't safely hashable. Client should check existence + skip if retrying. The matching DELETE /api/v1/products/{id}/images/{index} removes a single image by zero-based index. Every upload is checked before storage: the bytes must match the declared image type (415 otherwise) and the file is virus-scanned (422 if malware is found, 503 if the scanner is briefly unavailable — retry).
Path parameters
- idrequired
string (24 hex chars)
Product ID.
Headers
- Authorizationrequired
string
Bearer <token>— either atp_API key (Developer → API Keys; simplest, for server-to-server) or an OAuth 2.0 access token (Developer → OAuth Apps; for user-authorized apps, scoped + revocable). The Authentication page has the full OAuth flow and scope list.e.g. Bearer tp_REDACTED_xxxxxxxxxxxx
- Content-Typerequired
string
multipart/form-datawith the boundary parameter set by your HTTP client.
Body fields
- filerequired
binary (PNG / JPG / WebP, ≤ 5 MB)
Image bytes posted as the
fileform field.
Request
curl -sS -X POST \
https://app.tracepass.eu/api/v1/products/6650a1b2c3d4e5f6a7b8c9d0/images \
-H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" \
-F "file=@./battery-hero.jpg"Response
{
"imageUrl": "https://<public-image-host>/<imageId>.jpg",
"imageUrls": [
"https://example.com/existing-image-1.jpg",
"https://<public-image-host>/<imageId>.jpg"
]
}