# POST /api/hostedpaymentpages/images/upload

Uploads a banner or product image and returns the generated blob filename plus its CDN preview URL.

Accepts multipart/form-data (max 2 MB, max 4000x4000 pixels; gif, jpg, jpeg, png, or webp). The stored
filename is server-generated; place the returned `blobName` in a page's `bannerImage` or
`productImageBlobName`. Invalid uploads return a field-attributed 400 validation error.

**Operation ID:** `POST_api_hostedpaymentpages_images_upload`

## Authorization

Requires: HostedPaymentPage.HostedPaymentPages.Update, merchant scope.

Required permissions:
- `HostedPaymentPage.HostedPaymentPages.Update`

## Parameters

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| suppressNulls | query | no | boolean | If true, omit properties with null values. |

## Request Body

**Content type:** `multipart/form-data`

Properties:
- `File` (string(binary)): The uploaded image content. The multipart filename is used only to read the claimed extension              for the magic-byte cross-check; it never becomes the stored name. Required: the endpoint rejects a              missing file with a field-attributed validation error.
- `ExtraProperties` (object)

## Responses

### 200

OK

**Content type:** `text/plain`

Schema: `PhoeniXGateHostedPaymentPageHostedPaymentPagesImagesHppImageUploadResultDto`

**Content type:** `application/json`

Schema: `PhoeniXGateHostedPaymentPageHostedPaymentPagesImagesHppImageUploadResultDto`

**Content type:** `text/json`

Schema: `PhoeniXGateHostedPaymentPageHostedPaymentPagesImagesHppImageUploadResultDto`

### 400

Bad Request

### 403

Forbidden

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 401

Unauthorized

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 404

Not Found

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 501

Not Implemented

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 500

Internal Server Error

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### default

The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. See the error-code reference in this document's description for the values `error.code` can take.

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

## See also

- [All documentation](https://docs.winkpg.io/llms.txt): the machine-readable index of every public page on this site.