Approved uploads endpoint
Upload approved membership pass imagery.
POST /uploads/membership-pass-images requires the explicit uploads:write scope when called with a merchant API token.
Request
Upload approved membership pass imagery. The path is relative to the global /api/v1 prefix.
Authorization
uploads:writeUpload approved merchant brand and catalog imagery.
Interactive JWT requests bypass API-token scope metadata, but continue through the normal role, merchant, and permission guards. API tokens are denied on routes without an explicit token policy.
Parameters & body
This route has no path parameters in the published merchant-token contract.
API.md confirms this route, its scope, and security boundaries, but delegates feature-specific request bodies to the current backend service contract. The docs do not fabricate field names.
Examples
API.md does not publish multipart field names, accepted MIME types, or file-size limits. An empty POST would be misleading, so this page will not present one as a working example.
Response contract
API.md states that response bodies are produced by existing feature services; their resource-specific schemas are authoritative. The merchant-token document does not publish a stable success schema or feature-specific error list for this route.
Authentication errors
401 for invalid/inactive credentials; 403 for missing scopes, blocked routes, or inactive merchant state.
Feature errors
Validation, not-found, and conflict errors are owned by the underlying feature service and are not enumerated in API.md.