Users & Account Operations¶

Authenticated profile, private asset, upload, liked-asset and collection-management operations are grouped here. Every operation on this page requires a bearer token.

Read Your Profile¶

Set ICOSA_ACCESS_TOKEN securely in your environment. Examples intentionally avoid exposing tokens in frontend JavaScript.

curl --fail-with-body \
  --header "Authorization: Bearer $ICOSA_ACCESS_TOKEN" \
  "https://galleryapi.dabbble.app/v1/users/me"

<?php
$url = 'https://galleryapi.dabbble.app/v1/users/me';
$headers = "Accept: application/json\r\n";
$token = getenv('ICOSA_ACCESS_TOKEN');
if (!$token) { exit('Set ICOSA_ACCESS_TOKEN'); }
$headers .= "Authorization: Bearer $token\r\n";
$context = stream_context_create(['http' => [
    'timeout' => 20, 'header' => $headers
]]);
$body = @file_get_contents($url, false, $context);
if ($body === false) { exit('API request failed.'); }
$data = json_decode($body, true);
if (!is_array($data)) { exit('Invalid JSON response.'); }
echo '<pre>' . htmlspecialchars(json_encode($data, JSON_PRETTY_PRINT),
    ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '</pre>';
?>

// Save as example.mjs and run: node example.mjs
const token = process.env.ICOSA_ACCESS_TOKEN;
if (!token) throw new Error('Set ICOSA_ACCESS_TOKEN');
async function main() {
  const response = await fetch('https://galleryapi.dabbble.app/v1/users/me', {
    headers: { Accept: 'application/json', Authorization: `Bearer ${token}` },
    signal: AbortSignal.timeout(20000)
  });
  if (!response.ok) throw new Error(`HTTP ${response.status}`);
  console.log(await response.json());
}
main().catch(error => { console.error(error.message); process.exitCode = 1; });

import json
import os
from urllib.request import Request, urlopen
from urllib.error import HTTPError, URLError

headers = {'Accept': 'application/json'}
headers['Authorization'] = 'Bearer ' + os.environ['ICOSA_ACCESS_TOKEN']
request = Request('https://galleryapi.dabbble.app/v1/users/me', headers=headers)
try:
    with urlopen(request, timeout=20) as response:
        data = json.load(response)
    print(json.dumps(data, indent=2))
except (HTTPError, URLError, TimeoutError, ValueError) as error:
    print(f'API request failed: {error}')

using System;
using System.Net.Http;
using System.Text.Json;
using System.Threading.Tasks;
using var client = new HttpClient { Timeout = TimeSpan.FromSeconds(20) };
client.DefaultRequestHeaders.Accept.ParseAdd("application/json");
var token = Environment.GetEnvironmentVariable("ICOSA_ACCESS_TOKEN")
    ?? throw new InvalidOperationException("Set ICOSA_ACCESS_TOKEN");
client.DefaultRequestHeaders.Authorization =
    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
try
{
    using var response = await client.GetAsync("https://galleryapi.dabbble.app/v1/users/me");
    response.EnsureSuccessStatusCode();
    using var document = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
    Console.WriteLine(document.RootElement);
}
catch (Exception error) when (error is HttpRequestException
    or TaskCanceledException or JsonException)
{
    Console.Error.WriteLine(error.Message);
}

Account Workflows¶

Profile updates¶

Response fields use displayName, while PATCH bodies use displayname. Preserve that casing difference. Updates accept url, displayname and description, all optional and nullable.

Asset uploads¶

Creation uses multipart form data. The declared fields are files, triangleCount, remixIds and formatOverride. None of these individual fields is marked required, although the request body itself is required. Do not interpret this as a guarantee that an empty upload will be accepted.

A successful upload returns UploadJobSchemaOut containing assetId and publishUrl. Publication steps, supported file extensions, limits and processing states are not described.

Thumbnails¶

Both thumbnail upload operations require multipart field image. Let your HTTP client generate the multipart boundary. Do not send a filename string as though it were file content.

Collection writes¶

Creation requires name; other fields are optional. PATCH fields are all optional. The membership field is exactly asset_url, an array, not assetUrls.

The dedicated PUT set_assets operation overwrites membership. Review the intended final list before calling it. The response wrapper contains collection and may include rejectedAssetUrls; inspect rejections rather than assuming every asset was accepted.

Deletion¶

Deletion changes stored content and should require a deliberate user decision. HTTP 204 responses have no JSON body. Do not parse them as JSON.

Upload Examples¶

These examples upload a local file and therefore change server state. Run them only when intended. Format and filename examples are illustrative, not a guarantee of accepted extensions.

curl --fail-with-body \
  --header "Authorization: Bearer $ICOSA_ACCESS_TOKEN" \
  --form "[email protected]" \
  --form "triangleCount=25000" \
  "https://galleryapi.dabbble.app/v1/users/me/assets"

import { readFile } from 'node:fs/promises';
const token = process.env.ICOSA_ACCESS_TOKEN;
if (!token) throw new Error('Set ICOSA_ACCESS_TOKEN');
const form = new FormData();
form.append('files', new Blob([await readFile('model.glb')]), 'model.glb');
form.append('triangleCount', '25000');
const response = await fetch('https://galleryapi.dabbble.app/v1/users/me/assets', {
  method: 'POST', headers: { Authorization: `Bearer ${token}` },
  body: form, signal: AbortSignal.timeout(60000)
});
if (!response.ok) throw new Error(`HTTP ${response.status}`);
console.log(await response.json());

import json
import os
from pathlib import Path
from urllib.request import Request, urlopen
from uuid import uuid4
boundary = uuid4().hex
body = (
    f'--{boundary}\r\n'
    'Content-Disposition: form-data; name="files"; filename="model.glb"\r\n'
    'Content-Type: application/octet-stream\r\n\r\n'
).encode() + Path('model.glb').read_bytes() + (
    f'\r\n--{boundary}--\r\n'
).encode()
request = Request(
    'https://galleryapi.dabbble.app/v1/users/me/assets',
    data=body, method='POST', headers={
        'Authorization': 'Bearer ' + os.environ['ICOSA_ACCESS_TOKEN'],
        'Content-Type': f'multipart/form-data; boundary={boundary}'
    }
)
with urlopen(request, timeout=60) as response:
    print(json.load(response))

The Python template reads the file into memory; choose a streaming upload approach for large files. Upload examples let HTTP exceptions fail visibly rather than pretending a failed upload succeeded.

Endpoint Reference¶

Public author and licence filters are not declared on the private asset-list endpoint; it instead includes visibility. Liked assets expose the public-style filters. Only send parameters declared for the specific operation.

GET /v1/users/me¶

Show My User

Authentication: HTTP bearer token.

PATCH /v1/users/me¶

Update My User

Authentication: HTTP bearer token.

Request body: required.

Content type: application/json.

Body schema: PatchUserSchema.

GET /v1/users/me/assets¶

List My Assets

Authentication: HTTP bearer token.

POST /v1/users/me/assets¶

Create A New Asset

Authentication: HTTP bearer token.

Request body: required.

Content type: multipart/form-data.

GET /v1/users/me/assets/{asset_url}¶

Show An Asset

Authentication: HTTP bearer token.

DELETE /v1/users/me/assets/{asset_url}¶

Delete An Asset

Authentication: HTTP bearer token.

POST /v1/users/me/assets/{asset_url}/set_thumbnail¶

Set An Image For An Asset

Authentication: HTTP bearer token.

Request body: required.

Content type: multipart/form-data.

GET /v1/users/me/likedassets¶

List My Likedassets

Authentication: HTTP bearer token.

GET /v1/users/me/collections¶

Get My Collections

Authentication: HTTP bearer token.

POST /v1/users/me/collections¶

Create A Collection

Authentication: HTTP bearer token.

Request body: required.

Content type: application/json.

Body schema: AssetCollectionPostSchema.

GET /v1/users/me/collections/{asset_collection_url}¶

Show A Collection

Authentication: HTTP bearer token.

PATCH /v1/users/me/collections/{asset_collection_url}¶

Update A Collection

Authentication: HTTP bearer token.

Request body: required.

Content type: application/json.

Body schema: AssetCollectionPatchSchema.

DELETE /v1/users/me/collections/{asset_collection_url}¶

Delete A Collection

Authentication: HTTP bearer token.

PUT /v1/users/me/collections/{asset_collection_url}/set_assets¶

Overwrite Assets For A Collection

Authentication: HTTP bearer token.

Request body: required.

Content type: application/json.

Body schema: AssetCollectionPutSchema.

POST /v1/users/me/collections/{asset_collection_url}/set_thumbnail¶

Set An Image For A Collection

Authentication: HTTP bearer token.

Request body: required.

Content type: multipart/form-data.

Request and Response Schemas¶

Public asset fields are documented under Assets. Private assets add state. Nested file metadata is under Files & Formats. state and list-query visibility are plain strings without declared enums; do not infer their full accepted vocabulary from collection visibility values.

FullUserSchema¶

PatchUserSchema¶

AssetSchemaPrivate¶

PagedAssetSchemaPrivate¶

UploadJobSchemaOut¶

AssetMetaData¶

AssetCollectionPostSchema¶

AssetCollectionPatchSchema¶

AssetCollectionPutSchema¶

AssetCollectionSchemaWithRejections¶

AssetVisibility¶

PRIVATE, PUBLIC, UNLISTED

Error¶