> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fetchski-attract.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Replace an image

> Replaces the whole document: every field left out is reset to its default.

```ts AdonisJS wrap theme={"dark"}
import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const image = await site.media().replaceImage({ id: 'ckitdo5oq004pu69kr6oxo6fr:en:published', title: 'Hero banner image', attachment: { id: 'ckj0akbxa003vp39kfbxgb8zg', name: 'blue-box', title: 'blue box', extension: 'png', type: 'attachment', group: 'images', length: 10497, md5: '630eeaaecd0bdc07c4a82eeca4c07588', docIds: ['clx8m2k4p0000a1b2c3d4e5f6'], archivedDocIds: ['clx8m2k4p0000a1b2c3d4e5f6'], createdAt: new Date('2026-01-01T00:00:00.000Z') } })
```

```json 200 wrap theme={"dark"}
{
  "_id": "clx1234567890abcdef",
  "title": "Hero banner image",
  "slug": "hero-banner-image",
  "type": "@apostrophecms/image",
  "archived": false,
  "visibility": "public",
  "attachment": {
    "_id": "ckj0akbxa003vp39kfbxgb8zg",
    "_url": "https://example.net/uploads/attachments/ckj0akbxa003vp39kfbxgb8zg-blue-box.png",
    "_urls": {
      "key": "Example value"
    },
    "name": "blue-box",
    "title": "blue box",
    "extension": "png",
    "type": "attachment",
    "group": "images",
    "length": 10497,
    "md5": "630eeaaecd0bdc07c4a82eeca4c07588",
    "width": 600,
    "height": 106,
    "landscape": true,
    "portrait": true,
    "docIds": [
      "clx8m2k4p0000a1b2c3d4e5f6"
    ],
    "archivedDocIds": [
      "clx8m2k4p0000a1b2c3d4e5f6"
    ],
    "createdAt": "2026-10-24T09:30:00.000Z",
    "updatedAt": "2026-10-24T09:30:00.000Z",
    "_isCroppable": true,
    "crop": {},
    "used": true,
    "folderId": "clx8m2k4p0000a1b2c3d4e5f6",
    "folderPath": "Example folder path"
  },
  "credit": "Example credit",
  "createdAt": "2026-10-24T09:30:00.000Z",
  "updatedAt": "2026-10-24T09:30:00.000Z",
  "copyOfId": "ckhdscx5900054z9k88uqs16w:en:published",
  "alt": "Example alt",
  "_tags": [
    {}
  ],
  "creditUrl": "https://acme.example/example",
  "_folder": [
    {}
  ],
  "feedId": "clx8m2k4p0000a1b2c3d4e5f6",
  "feedGeneration": "Example feed generation",
  "feedOrder": 1,
  "feedSourceKey": "Example feed source key",
  "aposShareKey": "k3v9x2m7q1z8w4p6"
}
```

## In your app

A controller answers a route on your app: it calls `replaceImage()` and returns the answer.

**1. Add the controller**

```ts app/controllers/replace_image_controller.ts theme={"dark"}
import { inject } from '@adonisjs/core'
import type { HttpContext } from '@adonisjs/core/http'
import { SiteClient } from '@fetchski/attract-cms-sdk'

@inject()
export default class ReplaceImageController {
  constructor(protected site: SiteClient) {}

  async handle({ params }: HttpContext) {
    return this.site.media().replaceImage({ id: params.id, title: 'Hero banner image', attachment: { id: 'ckj0akbxa003vp39kfbxgb8zg', name: 'blue-box', title: 'blue box', extension: 'png', type: 'attachment', group: 'images', length: 10497, md5: '630eeaaecd0bdc07c4a82eeca4c07588', docIds: ['clx8m2k4p0000a1b2c3d4e5f6'], archivedDocIds: ['clx8m2k4p0000a1b2c3d4e5f6'], createdAt: new Date('2026-01-01T00:00:00.000Z') } })
  }
}
```

The other values are the example’s: take yours from the request, a form or your database.

**2. Add the route**

```ts start/routes.ts theme={"dark"}
import router from '@adonisjs/core/services/router'

const ReplaceImageController = () => import('#controllers/replace_image_controller')

router.put('/image/:id', [ReplaceImageController])
```

Put it behind your auth middleware (`.use(middleware.auth())`): it acts with your key’s access.

**3. Call it**

Your own page’s form or script sends `PUT /image/ckitdo5oq004pu69kr6oxo6fr:en:published` and gets back its answer as JSON. Test it, below, calls it.

PATCH changes only the fields sent. Completely replace an image document by ID using PUT semantics

## Find the id

`id` is the document’s `_id`, from a list. Ask the list for only the fields you need: each row is a document’s `id` and those fields.

```ts AdonisJS wrap theme={"dark"}
import app from '@adonisjs/core/services/app'
import { SiteClient } from '@fetchski/attract-cms-sdk'

const site = await app.container.make(SiteClient)
const row = (await site.media().listImagesPick(['title', 'slug'])).find((each) => each.slug === 'getting-started') // { id, title, slug }, or undefined
```

Pass `row.id` as `id`. Drafts: list with `{ aposMode: 'draft' }` to get the draft’s id ([Find an id](https://docs.fetchski-attract.com/find-an-id.md)).

> [accordion] Required parameters
>
> One object, e.g. `replaceImage({ id })`; leave out the optional fields.
>
> **id** `string` *required*
>
> **Required.** Computed document ID (can optionally include mode and locale, e.g., id:en:published) Matches `^\S+$`.
>
> **title** `string` *required*
>
> **Required.** Image title/alt text.
>
> **attachment** `Attachment` *required*
>
> **Required.** File attachment information from upload endpoint.
>
> **Attachment**
>
> **id** `string` *required*
>
> **Required.** Unique attachment identifier.
>
> **name** `string` *required*
>
> **Required.** Slugified filename.
>
> **title** `string` *required*
>
> **Required.** Sortified filename.
>
> **extension** `string` *required*
>
> **Required.** File extension.
>
> **type** `string` *required*
>
> **Required.** Always `attachment`.
>
> **group** `string` *required*
>
> **Required.** File group type.
>
> **length** `number` *required*
>
> **Required.** File size in bytes.
>
> **md5** `string` *required*
>
> **Required.** MD5 checksum.
>
> **docIds** `readonly string[]` *required*
>
> **Required.** IDs of documents using this attachment.
>
> **archivedDocIds** `readonly string[]` *required*
>
> **Required.** IDs of archived documents using this attachment.
>
> **createdAt** `Date` *required*
>
> **Required.** When it was uploaded (ISO 8601). Format: an ISO 8601 date and time.
>
> **url** `string`
>
> The file’s URL: set for a file that is not an image. An image’s URLs are in `_urls`, by size (`original` is the file as uploaded).
>
> **urls** `Readonly\<Record\<string, string\>\>`
>
> An image’s URLs by size (`original`, `max`, `full`, `two-thirds`, `one-half`, `one-third`, `one-sixth`); unset for other files.
>
> **width** `number`
>
> Image width in pixels (images only)
>
> **height** `number`
>
> Image height in pixels (images only)
>
> **landscape** `boolean`
>
> Whether image is landscape orientation (images only)
>
> **portrait** `boolean`
>
> Whether image is portrait orientation (images only)
>
> **updatedAt** `Date`
>
> When it last changed (ISO 8601). Format: an ISO 8601 date and time.
>
> **isCroppable** `boolean`
>
> Whether the image can be cropped.
>
> **crop** `Readonly\<Record\<string, unknown\>\> | null`
>
> The crop applied, if any (`top`, `left`, `width`, `height`).
>
> **used** `boolean`
>
> Whether any document uses the file.
>
> **folderId** `string | null`
>
> The media folder holding the file, by its `aposDocId`.
>
> **folderPath** `string`
>
> That folder’s path, e.g. `events/summer`.

> [accordion] Optional parameters
>
> **aposMode** `AposMode | null | undefined`
>
> **Optional.** Leave it out and the site uses `"published"`. `published` (the default) or `draft`. Drafts need a credential that may see them: an API key with the type’s write scope (`content:<type>:write`), or a signed-in editor. The public and a key with only the read scope get 403. One of `draft`, `published`.
>
> **aposLocale** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The locale to read or write, e.g. `en` (default: the site’s default locale).
>
> **slug** `string | null | undefined`
>
> **Optional.** Its URL name: lowercase words joined by hyphens. Left out, it’s made from the title.
>
> **archived** `boolean | null | undefined`
>
> **Optional.** Leave it out and the site uses `false`. In the archive: kept, but out of every list and off the site until it is restored. `false` (or null) for a live document.
>
> **visibility** `Visibility | null | undefined`
>
> **Optional.** Leave it out and the site uses `"public"`. Who may see it on the site: `public` (everyone) or `loginRequired` (signed-in people only). One of `public`, `loginRequired`.
>
> **credit** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. Image credit or attribution.
>
> **copyOfId** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The `_id` of the piece/page that was copied to create this document (only present if created via `_copyingId`)
>
> **alt** `string | null | undefined`
>
> **Optional.** Leave it out and the site uses `""`. Image description used for accessibility.
>
> **tags** `readonly Readonly\<Record\<string, unknown\>\>[] | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. Its tags, as documents.
>
> **creditUrl** `string | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. When set, a URL; empty or null when not.
>
> **folder** `readonly Readonly\<Record\<string, unknown\>\>[] | null | undefined`
>
> **Optional.** Leave it out (or pass `null`) and it isn’t sent: the site’s default applies. The media folder holding it (one at most; empty at the library’s root).

> [accordion] Returns
>
> An `Image`. Built-in image/media piece type for managing photos and graphics. Read its properties (`image.id`): each says whether the site always sends it. The example answer is the site’s wire JSON: some keys differ from the property names (`_id` → `id`, `_tags` → `tags`, `_folder` → `folder` …).
>
> **id** `string`
>
> **Always sent.** Unique identifier.
>
> **title** `string`
>
> **Always sent.** Image title/alt text.
>
> **slug** `string`
>
> **Always sent.** Its URL name: lowercase words joined by hyphens.
>
> **type** `string`
>
> **Always sent.**
>
> **visibility** `Visibility`
>
> **Always sent.** Who may see it on the site: `public` (everyone) or `loginRequired` (signed-in people only). One of `public`, `loginRequired`; a newer site may send others, so keep a fallback.
>
> **attachment** `Attachment`
>
> **Always sent.** An `Attachment`. File attachment information from upload endpoint.
>
> **Attachment**
>
> **id** `string`
>
> **Always sent.** Unique attachment identifier.
>
> **name** `string`
>
> **Always sent.** Slugified filename.
>
> **title** `string`
>
> **Always sent.** Sortified filename.
>
> **extension** `string`
>
> **Always sent.** File extension.
>
> **type** `string`
>
> **Always sent.** Always `attachment`.
>
> **group** `string`
>
> **Always sent.** File group type.
>
> **length** `number`
>
> **Always sent.** File size in bytes.
>
> **md5** `string`
>
> **Always sent.** MD5 checksum.
>
> **docIds** `readonly string[]`
>
> **Always sent.** IDs of documents using this attachment.
>
> **archivedDocIds** `readonly string[]`
>
> **Always sent.** IDs of archived documents using this attachment.
>
> **createdAt** `Date`
>
> **Always sent.** When it was uploaded (ISO 8601). Format: an ISO 8601 date and time.
>
> **url** `string`
>
> **Sometimes sent:** `undefined` when the site leaves it out. The file’s URL: set for a file that is not an image. An image’s URLs are in `_urls`, by size (`original` is the file as uploaded).
>
> **urls** `Readonly\<Record\<string, string\>\>`
>
> **Sometimes sent:** `undefined` when the site leaves it out. An image’s URLs by size (`original`, `max`, `full`, `two-thirds`, `one-half`, `one-third`, `one-sixth`); unset for other files.
>
> **width** `number`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Image width in pixels (images only)
>
> **height** `number`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Image height in pixels (images only)
>
> **landscape** `boolean`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Whether image is landscape orientation (images only)
>
> **portrait** `boolean`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Whether image is portrait orientation (images only)
>
> **updatedAt** `Date`
>
> **Sometimes sent:** `undefined` when the site leaves it out. When it last changed (ISO 8601). Format: an ISO 8601 date and time.
>
> **isCroppable** `boolean`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Whether the image can be cropped.
>
> **crop** `Readonly\<Record\<string, unknown\>\> | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. The crop applied, if any (`top`, `left`, `width`, `height`).
>
> **used** `boolean`
>
> **Sometimes sent:** `undefined` when the site leaves it out. Whether any document uses the file.
>
> **folderId** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. The media folder holding the file, by its `aposDocId`.
>
> **folderPath** `string`
>
> **Sometimes sent:** `undefined` when the site leaves it out. That folder’s path, e.g. `events/summer`.
>
> **createdAt** `Date`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **updatedAt** `Date`
>
> **Always sent.** Format: an ISO 8601 date and time.
>
> **archived** `boolean | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. In the archive: kept, but out of every list and off the site until it is restored. `false` (or null) for a live document.
>
> **credit** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Image credit or attribution.
>
> **copyOfId** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. The `_id` of the piece/page that was copied to create this document (only present if created via `_copyingId`)
>
> **alt** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Image description used for accessibility.
>
> **tags** `readonly Readonly\<Record\<string, unknown\>\>[] | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. Its tags, as documents.
>
> **creditUrl** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. When set, a URL; empty or null when not.
>
> **folder** `readonly Readonly\<Record\<string, unknown\>\>[] | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. The media folder holding it (one at most; empty at the library’s root).
>
> **feedId** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`.
>
> **feedGeneration** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`.
>
> **feedOrder** `number | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`.
>
> **feedSourceKey** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`.
>
> **aposShareKey** `string | null`
>
> **Sometimes sent:** `undefined` when the site leaves it out, and it can be `null`. The draft’s preview share key, while its share link is on: the link is the draft’s `_url` with `aposShareKey` and `aposShareId` (the draft’s `_id`) in its query. Absent otherwise, and on published documents.

> [accordion] Errors
>
> Nothing to catch: the SDK retries what is safe, and throws the rest as the classes below. Your exception handler turns them into your app’s own answers, once for every call (see [Map SDK errors to responses](https://docs.fetchski-attract.com/adonisjs/calling-the-api.md#map-sdk-errors-to-responses)); catch only what you want to react to here.
>
> **ValidationFailed** `400`
>
> The site refused what was sent: `errors` lists each field’s problem, `siteMessage` the first.
>
> **Retried first:** No. **Read:** `errors` (field → messages), `siteMessage`.
>
> **AuthenticationFailed** `401`
>
> The API key is missing or refused (malformed, revoked, expired), or a signature its signing mode needs is missing or stale.
>
> **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`.
>
> **Forbidden** `403`
>
> The key may not do this: a scope it lacks, or an address outside its allowlist. `siteMessage` names it.
>
> **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`.
>
> **NotFound** `404`
>
> Nothing matches, or the caller may not see it.
>
> **Retried first:** No. **Read:** `siteMessage`, `errorName`, `data`.
>
> **SiteError** `500`
>
> The site failed. Its logs say why.
>
> **Retried first:** No: a write may have landed. **Read:** `siteMessage`, `errorName`, `data`.
>
> **SiteUnreachable** `no answer`
>
> No answer: DNS, a refused connection, TLS, or the timeout (15 s per attempt by default).
>
> **Retried first:** Only when nothing reached the site (`neverConnected()`); never after a timeout, when it may have landed. **Read:** `reason`, `neverConnected`.
>
> **RequestNotSent** `not sent`
>
> The client refused to send it (e.g. a path segment of `..`); the site never saw it.
>
> **Retried first:** No. **Read:** `reason` (what to change).
>
> **SiteRequestFailed** `any other`
>
> Any other status, or a success whose JSON doesn’t match this SDK version’s types (update the SDK).
>
> **Retried first:** No. **Read:** `reason`, `status`.
>
> **UnknownSite** `setup`
>
> `sites.forSite('acme')` named a slug `config/attract.ts` doesn’t list (with the keys in the database: no row in `attract_api_keys`).
>
> **Retried first:** No: nothing was sent. **Read:** `message`, `slug`.
>
> **SiteConfigurationError** `setup`
>
> The site’s entry is wrong: a malformed `baseUrl` or key, a key filed under another slug, or no default site. `node ace attract:check` names the fix.
>
> **Retried first:** No: nothing was sent. **Read:** `message` (what to fix).

## Behavior

* **Access:** an API key with `content:images:write` (or a master above it: `content:images:all`, `content:all`, `admin:all`). A signed-in person may call it as far as their own permissions allow; anyone else gets 403.
* **Rate limit:** the key’s own writes-per-minute limit, set when the key is created (default 120); over it, 429 with `Retry-After`. The client waits and retries for you; you see `RateLimited` only if that runs out.
* **Retries:** a write is sent again only after a 429 (refused before it acted) or when it never reached the site. After a timeout or a 5xx it may have landed: check before you send it again.
* **Timeout:** 15 s per attempt by default; raise `timeout` (milliseconds) in `config/attract.ts` for longer.

## Test it

It calls the controller above with the SDK faked: `fakeAttract()` puts the fake in the container for this one test, and it answers every call with a valid example, so nothing leaves your machine and no key is read. Save it as `tests/unit/media_replace_image.spec.ts`, then run your tests:

```ts tests/unit/media_replace_image.spec.ts theme={"dark"}
import { test } from '@japa/runner'
import app from '@adonisjs/core/services/app'
import testUtils from '@adonisjs/core/services/test_utils'
import { fakeAttract } from '@fetchski/attract-cms-adonis/testing'
import ReplaceImageController from '#controllers/replace_image_controller'

test('media.replaceImage', async () => {
  const site = fakeAttract()

  const ctx = await testUtils.createHttpContext()
  ctx.params = { id: 'ckitdo5oq004pu69kr6oxo6fr:en:published' }
  const controller = await app.container.make(ReplaceImageController)
  await controller.handle(ctx)

  site.assertCalled('media.replaceImage', (args) => args.id === 'ckitdo5oq004pu69kr6oxo6fr:en:published')
})
```

```bash Terminal theme={"dark"}
node ace test
```

**Answer with your own values:** fake `media.replaceImage` with `factories.Image({...})`, the fields you give over a valid example (nested ones too).

```ts tests/unit/media_replace_image_answers.spec.ts theme={"dark"}
import { test } from '@japa/runner'
import { factories, fakeAttract } from '@fetchski/attract-cms-adonis/testing'

test('media.replaceImage answers your values', async ({ assert }) => {
  const site = fakeAttract({
    'media.replaceImage': factories.Image({ attachment: { id: 'Your value' } }),
  })

  const image = await site.media().replaceImage({ id: 'ckitdo5oq004pu69kr6oxo6fr:en:published', title: 'Hero banner image', attachment: { id: 'ckj0akbxa003vp39kfbxgb8zg', name: 'blue-box', title: 'blue box', extension: 'png', type: 'attachment', group: 'images', length: 10497, md5: '630eeaaecd0bdc07c4a82eeca4c07588', docIds: ['clx8m2k4p0000a1b2c3d4e5f6'], archivedDocIds: ['clx8m2k4p0000a1b2c3d4e5f6'], createdAt: new Date('2026-01-01T00:00:00.000Z') } })
  assert.containSubset(image, { attachment: { id: 'Your value' } })
})
```

## Related

> [card] [List images](https://docs.fetchski-attract.com/adonisjs/reference/media/list-images.md)
>
> `site.media().listImages()`

> [card] [Create an image](https://docs.fetchski-attract.com/adonisjs/reference/media/create-image.md)
>
> `site.media().createImage()`

> [card] [Archive images](https://docs.fetchski-attract.com/adonisjs/reference/media/archive-images.md)
>
> `site.media().archiveImages()`

> [card] [Crop images to a widget’s aspect ratio](https://docs.fetchski-attract.com/adonisjs/reference/media/autocrop-images.md)
>
> `site.media().autocropImages()`

> [card] [Copy images to another locale](https://docs.fetchski-attract.com/adonisjs/reference/media/localize-images.md)
>
> `site.media().localizeImages()`

> [card] [Publish images](https://docs.fetchski-attract.com/adonisjs/reference/media/publish-images.md)
>
> `site.media().publishImages()`

> [card] [PUT /@apostrophecms/image/\{\_id}](https://docs.fetchski-attract.com/api-reference/media/replace-an-image.md)
>
> The endpoint this calls, in the API reference: the HTTP request and answer, and every rule the site checks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.