Select a Programme report logo

When to use this endpoint

Upload the image through Customer Files, then choose a file from branding.files. Use file_id=0 to clear the explicit logo and allow renderer fallback.

Send operation fields inside one JSON-encoded data object. When data is present it replaces top-level operation fields; otherwise the handler accepts the top-level request. String data is limited to 2 MB. Reserved transport/internal keys are removed. Malformed or non-array JSON becomes an empty input, so validate JSON before sending.

Authentication and permissions

Authenticate with a signed API key or logged-in CRM session; session requests follow dispatcher CSRF checks. API-key requests use the key owner’s identity and permissions.

Requires the Contracts entitlement (features & 64), features2.contractProgrammes and Contracts View. Also requires features2.contractProgrammeQI. Requires Contracts Edit.

All storage belongs to the authenticated tenant. Contract operations follow the actor’s recursive HR manager/team scope, or the configured TeamAccess Contract/Department policy. Client administrators have broad Contract scope; private Programme and route ownership still applies. Active assignees must be within the permitted team.

Non-administrators also need Customers Edit. This operational logo setting does not grant permission to edit source-owned master data.

The tenant must have the Programme storage upgrade (foundation 803; independent route ownership 804 before planning). Requests never create or repair tables. A missing/incompatible storage failure can return an initialization/storage error or Contracts operation failed. Check the saved state before retrying.

Parameters

Parameter	Type	Required	Description
`customer_id`	Positive integer or digit string	Yes	Non-deleted Customer/Site linked to an in-scope Programme Contract, or the direct parent of a linked Customer. TeamAccess Customer scope also applies.
`file_id`	Integer-compatible	No	Casts to integer; zero/omitted clears, negative rejected. Positive File must belong to this exact Customer, be non-deleted and contain valid PNG/JPEG bytes. Max 2 MB and 4096 pixels in each dimension.

Example request

$result = FM_api('ContractProgramme_saveBranding', [
	'data' => json_encode([
		'customer_id' => 1043,
		'file_id' => 1110,
	]),
]);

Example response

{
  "ok": 1
}

Errors and unusual responses

Response	Condition
`{"error":"not logged in"}`	No authenticated tenant context is available. Invalid signed credentials can be rejected by the dispatcher before the handler runs.
`{"error":"Programme Contracts is not enabled"}`	Workspace flag or Contracts entitlement is disabled.
`{"error":"Permission denied"}`	Contracts View or the required action permission is unavailable.
`{"error":"This Contracts capability is not enabled"}`	The operation’s additional feature flag is disabled.
`{"error":"Customer edit permission is required"}`	Non-administrator lacks Customers Edit.
`{"error":"Choose a PNG or JPEG up to 2 MB and 4096 pixels"}`	Image bytes/type/size/dimensions invalid.
`{"error":"Upload a PNG or JPEG in this Customer’s Files first"}`	File missing/deleted or owned by another record.

Legacy application errors may be returned with HTTP 200. Check the decoded response for error, not only the HTTP status.

Behaviour and edge cases

Validates actual bytes rather than filename extension. A File belonging only to the parent is not valid for the Site selection; set branding on that parent separately.
Saves contract_programme_logo inside existing Customer metadata, preserving unrelated keys and source ownership. It neither uploads nor copies image bytes.
Setting 0 clears the explicit selection; Site-first/parent fallback is a renderer behaviour. This route itself does not render a report or email a PDF.

Side effects

The service serializes writes on the tenant owner in a transaction. Validation, persistence, audit or TeamAccess outstanding-Job access failures roll back that transaction. Successful changed writes refresh linked Contract/Customer sync timestamps and shared mobile update markers, then invalidate CRM caches after success. These operations do not create schema or enable account features.
Updates Customer metadata/last_edited and customer_logo_saved audit; shared sync/cache invalidation follows commit. No source master record is rewritten.

See it in Fieldmotion

CRM1

No direct caller was found in CRM1 source. This workflow is implemented by the opted-in CRM2 Programme Contracts workspace.

CRM2

In Programme Contract → Sites → Report Logo, choose an uploaded image or None and Save. Filter for ContractProgramme_saveBranding.

Related endpoints

ContractProgramme_branding — Read eligible Customer-owned Files first.