Upload an image for the front-page internal message

Used by the front-page message editor: the image is uploaded here, the returned URL is inserted into the HTML, and the HTML is then saved as the FrontPageInternalMessage setting (a separate PUT). Only users whose role has the front-page privilege may upload. Send multipart/form-data; only the FIRST part is used, and its own Content-Type header decides whether it is accepted — the bytes are not inspected. The image is stored under a new random name; nothing is ever overwritten, and nothing deletes it later.

Use it to:

Front-page message editor inserting a picture into the administrator's notice to all users

Not for:

Expense receipts — POST /v1/employee-expense/{employeeExpenseID}/image / POST /v1/project-expense/{expenseID}/file
Embedding images as data: URIs — the setting PUT refuses them (413)

Behaviour:

Not idempotent.
Safe to retry.
Side effect: Does NOT change the FrontPageInternalMessage setting — the caller must insert the URL into the HTML and save it.
On failure: 403 / 400 / 415 / 413: nothing is stored.
Changes are visible to the next read immediately.

curl -X POST "https://app3.timelog.com/your-account/api/v2/settings/frontpage-image" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

import requests
import json

url = "https://app3.timelog.com/your-account/api/v2/settings/frontpage-image"
headers = {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN"
}

response = requests.post(url, headers=headers)
print(response.json())

const response = await fetch("https://app3.timelog.com/your-account/api/v2/settings/frontpage-image", {
  method: "POST",
  headers: {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("POST", "https://app3.timelog.com/your-account/api/v2/settings/frontpage-image", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://app3.timelog.com/your-account/api/v2/settings/frontpage-image')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'

response = http.request(request)
puts response.body

{
  "location": "example_string"
}

{
  "error": "Error",
  "message": "- The first part is larger than 2 097 152 bytes (checked after the whole request is buffered; requests over 16 MB are refused earlier by IIS). — Fix: Resize or recompress the image to at most 2 MB.",
  "code": 413
}

{
  "Code": 100,
  "Message": "Unknown error occur in system, please contact system administrator.",
  "Details": [],
  "Parameters": "…",
  "Url": "https://app{server-number}.timelog.com/{account}/api/v2/settings/frontpage-image"
}

POST

/v2/settings/frontpage-image

POST

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token

OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp). The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.

Request Preview

Response

Response will appear here after sending the request

Authentication

header

Authorizationstring

Required

Bearer token. OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. JWT and reference tokens are both accepted. The token must carry the required scope (default tlp).

The token's sub claim is the acting user. A token WITHOUT sub (client-credentials) acts as the system service user. If the sub user cannot log in (inactive, locked, deleted), the request is rejected with 401 — it is no longer let through without a user.

Responses

locationstring

It is a bearer link: anyone holding it can read the image until it expires.

Set by TimeLog.

Property name is lower-case 'location' (anonymous object), unlike the PascalCase models of the rest of the API.

Was this page helpful?