Remote Photo lets an application ask an identity or visitor to supply a photo using the Remote Photo service. Remote Photo sends the email invitation and owns the capture, upload, validation, and approval experience. When a photo is ready, ICAP stores it in the person's normal photo field and starts the usual identity or visitor synchronization to eligible PACSs. This is asynchronous: creating a request, or seeing an approved request status, does not prove that a PACS has received the image.
Photo requests are available only for identities and visitors, not visits, credentials, or other resources. They are not an inline image-upload API or an image library. Use the matching /photoRequest endpoint for the person.
Photos are personal data. Limit access, avoid bulk downloads, and include them in your privacy design. A purge clears stored photo data from the primary person record but is not a promise that every external or backup copy has been erased; see privacy and lifecycle.
remotePhotoEnabled in the /features endpoint must be set to true for the RemotePhoto service to work.
Request a photo from an identity
The photo-request workflow asks the end user for a photo; it does not upload an image in the API response. To create an identity request, optionally select one of the identity's email types. The caller needs IdentityPhotoRequestCreate permission.
curl --fail-with-body --silent --show-error \
--request POST "$BASE_URL/identity/$IDENTITY_ID/photoRequest" \
--header "Authorization: Bearer $TOKEN" \
--header 'Content-Type: application/json' \
--data '{ "emailType": "work" }'
The response is a photo-request record. Preserve its state in the application rather than assuming that a request means a photo has been supplied:
{
"createdAt": "2026-09-07T10:15:00Z",
"email": "ada@example.example",
"status": "pending"
}
Use the matching GET and DELETE /identity/{identityId}/photoRequest routes to inspect or cancel it, subject to the endpoint permissions in the API contract. Visitor photo requests use the same payload under /visitor/{visitorId}/photoRequest and require the visitor-specific photo-request permissions.