403.404. The image itself is served without authentication at path (at most 48 by 48 pixels), path-small (the same image), and path-large (at most 256 by 256 pixels), so anyone who has the filename can load it. To read the current avatar without knowing its filename, call GET /domains/{domain}/users/{user}/avatar. Only GET and DELETE are served on this path; POST and PUT return 405 Method Not Allowed. Upload to the avatar collection path, not to a filename.Authorization: Bearer ********************curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/domains//users//avatar/5f0c2d8e9b7a4c1d3e6f8a0b2c4d6e8f.webp' \
--header 'Authorization: Bearer <token>'{
"filename": "5f0c2d8e9b7a4c1d3e6f8a0b2c4d6e8f.webp",
"user": "1001",
"domain": "example.com",
"filetype": "image/webp",
"filesize-large-bytes": 7852,
"filesize-small-bytes": 1026,
"path-large": "/ns-api/v2/avatar/256/5f0c2d8e9b7a4c1d3e6f8a0b2c4d6e8f.webp",
"path-small": "/ns-api/v2/avatar/48/5f0c2d8e9b7a4c1d3e6f8a0b2c4d6e8f.webp",
"path": "/ns-api/v2/avatar/5f0c2d8e9b7a4c1d3e6f8a0b2c4d6e8f.webp",
"created-datetime": "2026-09-01T14:30:00+00:00"
}