POST /api/v1/properties/{propertyId}/photo
Uploads a photo and attaches it to the villa. The body is multipart/form-data.
The image is compressed server-side, at the same tiers the app applies in the browser. A call coming from a script has been through no browser: without this pass, the API would store a full-resolution original where the screen would have stored a light one.
| Role in the organization | This endpoint |
|---|---|
owner | Allowed |
admin | Allowed |
member | Refused — 403 |
| Field | Type | Required | Description |
|---|---|---|---|
file | file | yes | image/jpeg, image/png or image/webp |
level | enum | no | light (1600px, q82), balanced (1200px, q72, default), strong (900px, q60) |
curl -X POST -H "x-api-key: $VILLASLOT_API_KEY" \
-F "file=@villa-suar.jpg" -F "level=balanced" \
"https://villaslot.app/api/v1/properties/1f0a…/photo"200 OK — the villa, with its new photoUrl.403 Forbidden — the key bearer is a member.422 Unprocessable Entity — no file field, an empty file, or an unknown level.401 Unauthorized — missing or invalid key, or a key whose bearer left the organization.404 Not Found — unknown id, or an id belonging to another organization. The two are
deliberately indistinguishable.429 Too Many Requests — over 120 requests in a minute for this key.