Remove an organization's avatar

DELETE/api/orgs/{org}/avatar

deleteOrganizationAvatar

Clears the organization's avatar; the SPA falls back to initials. A removal is durable: a later GitHub sync never re-adopts the provider's avatar. Owner or Admin only. Returns the refreshed org.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X DELETE 'https://neosource.dev/api/orgs/ORG/avatar' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN'

fetch

fetch("https://neosource.dev/api/orgs/ORG/avatar", {
  method: "DELETE",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
  },
});

Path parameters

orgrequired: Organization slug.
string

Responses

200Updated org

application/json

OrgResponse

object

avatar_url: string | null
Absolute URL of the organization's avatar on the cookieless content origin (`https://{content_origin}/avatars/{slug}?v={digest}`), or absent when it has none — the SPA renders initials then. Same shape as `UserResponse::avatar_url`; the `v` query is the stored digest.
created_atrequired: integerint64
descriptionrequired: string
display_namerequired: string
kindrequired: WorkspaceKind
string
The kind of workspace (namespace container).
"personal""organization"
slugrequired: string
updated_atrequired: integerint64
viewer_role: one of
WorkspaceRole
string
Workspace membership role. Ordered low → high (`Member < Admin < Owner`) so that `if actor_role >= WorkspaceRole::Admin` reads naturally.
"member""admin""owner"
null
workspace_idrequired: string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget