403 "XSRF check failed" when trying to upload avatar for asset

[Moritz Liegmann]

I used to upload avatar images to an asset in python similar to the following command:

curl \
  -F avatarUUID=<some-uuid> \
  -F file=@path/to/file.png \
  -H "Authorization: Bearer <access-token>" \
  https://jira.example.com/rest/assets/1.0/avatar/upload

After upgrading from 9.12.15 to 10.3.3 this call would always return a 403 error, saying "XSRF check failed". Application logs yield the following:

XSRF checks failed for request: https://jira.example.com/rest/assets/1.0/avatar/upload , origin: null , referrer: null
2025-04-28 08:12:53,203+0000 http-nio-8080-exec-4 url: /rest/assets/1.0/avatar/upload; user: <user> WARN <user> 492x131620x4 2e8gke <ip-addr>,<ip-addr> /rest/assets/1.0/avatar/upload

 From looking at documentation I cannot clearly determine another way to upload an avatar image for an asset specifically. Am I using the wrong API endpoint here?

[Marc - Devoteam]

Hi @Moritz Liegmann ,

Welcome to the community.

Going over the API options for Jira Service Management DC ,there is no endpoint to upload an assets icon.

https://developer.atlassian.com/server/jira-servicedesk/rest/v1006/intro/#about 

[Moritz Liegmann]

Hi @Marc - Devoteam

I can assure you the API endpoint exists. I am able to produce different error codes when I for example do not attach the image to the request.

[Marc - Devoteam]

Hi @Moritz Liegmann 

But the API doesn't specify this option anymore.

It might be that the API is still there based on that version 9 is still supported.