---
title: "Upload a profile image"
method: POST
path: "/api/v2/profile/images"
tags: ["Account Endpoints"]
---

# Upload a profile image

`POST /api/v2/profile/images`

Set contentType in the context request to the exact MIME type of the image bytes. This response starts a three-step upload flow. First, request this context from OpenSea. Second, call the returned method at the returned URL. For POST, add every fields entry unchanged as a multipart text field, then add a file part containing the bytes. The file part must be last. Let the HTTP library generate the multipart boundary; do not set the overall multipart Content-Type header yourself. POST storage uploads normally return 204. For PUT, upload the raw bytes, use only headers explicitly required by the endpoint, and expect 200. Treat any 2xx storage response as success. The URL and fields are short-lived sensitive credentials. Do not log, persist, alter, or put them in tickets. Third, after storage succeeds, pass the returned token to the documented OpenSea API endpoint. Do not use the token before the storage upload succeeds. Pass the token as the matching profile image field in PATCH /api/v2/profile.

## Request body

- UploadProfileImageRequest — Request body for uploading a profile image
  - `imageType` string, required — Image type to upload
  - `contentType` string, required — Exact MIME type of the image bytes

## Response `200`

Upload context returned successfully

- UploadContext — This response starts a three-step upload flow. First, request this context from OpenSea. Second, call the returned method at the returned URL. For POST, add every fields entry unchanged as a multipart text field, then add a file part containing the bytes. The file part must be last. Let the HTTP library generate the multipart boundary; do not set the overall multipart Content-Type header yourself. POST storage uploads normally return 204. For PUT, upload the raw bytes, use only headers explicitly required by the endpoint, and expect 200. Treat any 2xx storage response as success. The URL and fields are short-lived sensitive credentials. Do not log, persist, alter, or put them in tickets. Third, after storage succeeds, pass the returned token to the documented OpenSea API endpoint. Do not use the token before the storage upload succeeds.
  - `url` string, required — Short-lived storage URL. Use it exactly as returned and treat it as sensitive.
  - `method` 'POST' | 'PUT', required — HTTP method to use at url. Current upload contexts use POST.
  - `fields` object, required — Short-lived sensitive multipart text fields for POST. Submit every entry unchanged before the file part. Content-Type contains the exact MIME type required by the signed policy. This map is empty for PUT.
  - `token` string, required — Reference for the next OpenSea API call. Use it only after storage returns 2xx.

## Other responses

- `400` — For error reasons, review the response data.
- `401` — Invalid or missing API key
- `403` — Wallet token lacks permission for this request
- `404` — Not Found
- `409` — Conflict
- `500` — Internal Server Error

---

[API](https://skmtc.net/opensea/apis/opensea-api.md) · [All operations](https://skmtc.net/opensea/apis/opensea-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/opensea/opensea-api/versions/acee8835f2ae/schema)