> ## Documentation Index > Fetch the complete documentation index at: https://developers.tassyir.io/llms.txt > Use this file to discover all available pages before exploring further. # Upload an image from an address > Downloads the image at `url` and stores it on the Tassyir CDN; the answer's `url` is what product and collection writes accept. https on port 443 only, a public host name; a JPEG, PNG, GIF or WebP image (read from its bytes, never its name or `Content-Type`; SVG refused) of at most 10,000,000 bytes, 12,000 pixels on a side and 100 megapixels. Quota: 1,000 a UTC day per installation, 2,000 per business (every app together; a dev store 100 and 200), 30 a minute per installation. Send an `Idempotency-Key`: a retry then answers the same image without uploading it again. Needs the `write_products` scope (permission `products:create`). ## OpenAPI ````yaml /openapi/openapi.2026-10.json post /apps/2026-10/images openapi: 3.1.0 info: title: Tassyir Admin API version: 2026-10 summary: >- The API installed apps call to read and change a Tassyir business, and the webhooks they receive. description: >- Version `2026-10` of the API installed Tassyir apps call. The routes live under `/apps/2026-10/`; the token endpoint and the key documents under `/apps/`. Guides, and a page for every error code: https://developers.tassyir.io. **Authentication.** `Authorization: Bearer tsy_at_…` from `POST /apps/oauth/token`. An app acts as a team member of the business: it reads and writes only what its granted scopes allow, only in the stores the merchant gave it, under the merchant's plan. **Conventions.** JSON fields are camelCase; ids are strings; times are ISO 8601 UTC; money is a decimal string (`"2500.00"`) with a `currency` field, never a number. A list answers `{ data, nextCursor }`, newest first, keyset-paged: `limit` 1 to 100 (default 50), `cursor` = the previous `nextCursor`. A single resource answers `{ data }`. `fields` trims a resource to the named top-level fields. Fields without `read_customer_contact` (buyer name, phones, address, notes) are omitted, not nulled. Every answer is `Cache-Control: no-store`. **Writes.** Send an `Idempotency-Key` to make a write safe to retry (24 hours per installation). **Errors.** `application/problem+json` with a stable `code`, a `fix` sentence, the `docs` page of the code and a `requestId`. Each operation lists every code it can answer; `x-tassyir-errors` lists every code a problem can carry, with its title, statuses and `fix`. HTTP 460 `STORE_SCOPE_FORBIDDEN` means a store outside the installation's stores. **Rate limits.** A leaky bucket per installation, by default 40 requests refilled at 4 a second: every answer carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`; a refusal is 429 `RATE_LIMITED` with `Retry-After`. All the apps of one business also share a ceiling, by default 20 requests a second: 429 `BUSINESS_RATE_LIMITED` with `Retry-After`. An API process that is already running its maximum of app requests answers 503 `API_BUSY` with `Retry-After`, having done nothing. **Webhooks.** Signed Standard Webhooks deliveries (`v1a`, Ed25519), one per topic below; verify them with `GET /apps/webhook-keys`. servers: - url: https://api.tassyir.io security: - appAccessToken: [] tags: - name: Authentication description: Tokens and the public keys apps verify with. - name: Business description: The business the app is installed on. - name: Orders description: Orders, their comments and the cancel reasons. - name: Products description: Products and their variants. - name: Collections description: Collections and their members. - name: Inventory description: Stock levels. - name: Customers description: The buyers behind the orders. - name: Stores description: The installation's stores. - name: Delivery description: Delivery agents and fee groups (never credentials). - name: Data description: >- Typed values the app keeps on the business, its stores, products, orders and customers, under keys its manifest declares. - name: Images description: >- Images re-hosted on the Tassyir CDN, for the product and collection writes. - name: Bulk exports description: >- A whole list (orders, products, customers) as one JSON Lines file, instead of paging through it. - name: Webhooks description: What Tassyir POSTs to the app. paths: /apps/2026-10/images: post: tags: - Images summary: Upload an image from an address description: >- Downloads the image at `url` and stores it on the Tassyir CDN; the answer's `url` is what product and collection writes accept. https on port 443 only, a public host name; a JPEG, PNG, GIF or WebP image (read from its bytes, never its name or `Content-Type`; SVG refused) of at most 10,000,000 bytes, 12,000 pixels on a side and 100 megapixels. Quota: 1,000 a UTC day per installation, 2,000 per business (every app together; a dev store 100 and 200), 30 a minute per installation. Send an `Idempotency-Key`: a retry then answers the same image without uploading it again. Needs the `write_products` scope (permission `products:create`). operationId: uploadImage parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UploadImageInput' responses: '201': description: Uploaded. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Cache-Control: $ref: '#/components/headers/Cache-Control-No-Store' Idempotent-Replayed: $ref: '#/components/headers/Idempotent-Replayed' content: application/json: schema: $ref: '#/components/schemas/ImageResponse' '400': description: >- Bad request: `BAD_REQUEST`, `IDEMPOTENCY_KEY_INVALID`, `IMAGE_FETCH_FAILED`, `IMAGE_TOO_LARGE`, `IMAGE_TYPE_NOT_ALLOWED`, `IMAGE_URL_NOT_ALLOWED`, `VALIDATION_FAILED`. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - BAD_REQUEST - IDEMPOTENCY_KEY_INVALID - IMAGE_FETCH_FAILED - IMAGE_TOO_LARGE - IMAGE_TYPE_NOT_ALLOWED - IMAGE_URL_NOT_ALLOWED - VALIDATION_FAILED '401': $ref: '#/components/responses/Unauthorized' '403': description: 'Not allowed: `PERMISSION_DENIED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - PERMISSION_DENIED '409': description: 'Conflict: `IDEMPOTENCY_KEY_IN_USE`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 409 code: enum: - IDEMPOTENCY_KEY_IN_USE '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '422': description: 'Unprocessable: `IDEMPOTENCY_KEY_REUSED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 422 code: enum: - IDEMPOTENCY_KEY_REUSED '429': description: >- Rate limited: `BUSINESS_RATE_LIMITED`, `IMAGE_QUOTA_REACHED`, `RATE_LIMITED`. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Retry-After: $ref: '#/components/headers/Retry-After' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - BUSINESS_RATE_LIMITED - IMAGE_QUOTA_REACHED - RATE_LIMITED '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/UnavailableForWrite' components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: >- Makes a write safe to retry: the same key with the same method, path, query and body within 24 hours answers the stored result (`Idempotent-Replayed: true`) without running the write again. Only a successful answer is stored, so a retry after a failure runs. A key reused for a different request is 422 `IDEMPOTENCY_KEY_REUSED`; one whose first request still runs is 409 `IDEMPOTENCY_KEY_IN_USE`. schema: type: string minLength: 1 maxLength: 255 pattern: ^[\x21-\x7E]+$ example: 3f2a1c9e-8a4b-4f5e-9d61-2c7b0e4a91d3 schemas: UploadImageInput: type: object properties: url: maxLength: 2048 type: string minLength: 1 additionalProperties: false required: - url ImageResponse: type: object properties: data: $ref: '#/components/schemas/Image' required: - data additionalProperties: false Problem: type: object description: >- An Admin API error (RFC 9457 problem details), served as `application/problem+json`. Act on `code`, never on `detail`. Other members name the subject of the refusal (`permission`, `storeId`, `feature`, `limit`, `errors`, …). properties: type: type: string format: uri description: >- `https://developers.tassyir.io/errors/`: identifies the code, and is the code's page. title: type: string status: type: integer detail: type: string description: >- For a person. A 5xx never carries an internal message: `requestId` names it. code: type: string pattern: ^[A-Z][A-Z0-9_]{1,63}$ description: 'Stable: what the app acts on.' fix: type: string description: One sentence an AI agent can act on. docs: type: string format: uri description: >- The page that explains the code and what to do: the same URL as `type`. requestId: type: string description: Also in the `X-Request-Id` header. Quote it to Tassyir. errors: type: array items: type: string description: 'With `VALIDATION_FAILED`: one entry per invalid parameter.' required: - type - title - status - detail - code - docs Image: type: object properties: id: type: string minLength: 1 maxLength: 64 description: 'The image''s id: its entry in the merchant''s media library.' url: type: string pattern: ^https:\/\/cdn\.tassyir\.io\/ description: >- The image on the Tassyir CDN, in the business's variant. Put it as it is in a product's `images` or `variants[].image`, a collection's `image`, or an `` of a description. contentType: type: string enum: - image/jpeg - image/png - image/gif - image/webp description: What the downloaded bytes are, read from the file itself. sizeBytes: type: integer minimum: 1 maximum: 10000000 description: The size of the downloaded file in bytes. width: type: integer minimum: 1 maximum: 12000 description: Width in pixels, from the file header. height: type: integer minimum: 1 maximum: 12000 description: Height in pixels, from the file header. required: - id - url - contentType - sizeBytes - width - height additionalProperties: false description: An image uploaded to the Tassyir CDN (API 2026-10). headers: RateLimit-Limit: description: >- The installation's request bucket (default 40); on a 429 `BUSINESS_RATE_LIMITED`, the business's ceiling (default 20 a second). Absent when a request is refused before the rate limits run (an unparsable body, a 503 `API_BUSY`). schema: minimum: 1 type: integer RateLimit-Remaining: description: Requests still accepted right now. schema: type: integer minimum: 0 RateLimit-Reset: description: >- Seconds until the bucket is empty again (it drains at 4 requests a second by default). schema: type: integer minimum: 0 X-Request-Id: description: The request's id, also in an error's `requestId`. schema: type: string Cache-Control-No-Store: description: '`no-store`: never cache an answer.' schema: type: string const: no-store Idempotent-Replayed: description: >- Present on the stored answer of a write repeated with the same `Idempotency-Key`: the write did not run again. schema: type: string const: 'true' Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 responses: Unauthorized: description: 'No usable access token: `APP_TOKEN_INVALID`, `APP_TOKEN_REQUIRED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' WWW-Authenticate: description: The Bearer challenge (RFC 6750). schema: type: string content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - APP_TOKEN_INVALID - APP_TOKEN_REQUIRED PayloadTooLarge: description: 'Body too large: `PAYLOAD_TOO_LARGE`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - PAYLOAD_TOO_LARGE UnsupportedMediaType: description: 'Unsupported body: `UNSUPPORTED_MEDIA_TYPE`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - UNSUPPORTED_MEDIA_TYPE InternalError: description: 'Internal error: `INTERNAL_ERROR`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 500 code: enum: - INTERNAL_ERROR UnavailableForWrite: description: >- Unavailable: `API_BUSY`, `IDEMPOTENCY_UNAVAILABLE`, `SERVICE_UNAVAILABLE`. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Retry-After: $ref: '#/components/headers/Retry-After' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - API_BUSY - IDEMPOTENCY_UNAVAILABLE - SERVICE_UNAVAILABLE securitySchemes: appAccessToken: type: http scheme: bearer bearerFormat: tsy_at_<43 base62> description: >- An app access token from `POST /apps/oauth/token`, valid 1 hour. An offline token acts as the app; an online token acts as the app on behalf of one dashboard user (the intersection of both permission sets). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.