Image Library Upload Shows 'Error'

Internal reference for diagnosing and fixing generic upload failures in Image Library — caused by missing S3 Protected Endpoint configuration, common after sandbox refresh or clone.

Version 10 minutes | Feature: Image Library / S3 Upload Gallery
Duration 10 minutes
Feature Image Library / S3 Upload
Golden Config
Outcome

Prerequisites

  • ● LMA (License Management App) access to the target Salesforce org
  • ● System Administrator or equivalent setup access in the org via LMA login

Demo Steps

1

Confirm the symptom

Action

Reproduce the upload failure. Navigate to Image Library (e.g. Channel > Templates > Image Library, or a Service > Content tab > Upload Image). Select a valid PNG, JPEG, or GIF file under 20 MB. Note that the UI shows a generic 'Error' message with no further detail.

Expected Result

Upload fails with a generic 'Error' toast. The file type and size meet platform restrictions.

Talking Points
  • 💬 This affects Image Library uploads across Templates, Services Content tab, and other Image Library entry points
  • 💬 The error message gives no detail — the failure happens during the browser POST to AWS S3
2

Confirm root cause (optional)

Action

Open browser DevTools > Network tab and retry the upload. Look for a POST to kaptiotravel.s3.amazonaws.com. A 403 response confirms an S3 credentials or policy issue.

Expected Result

Network tab shows a failed POST to S3 with HTTP 403 (or similar non-2xx response).

Talking Points
  • 💬 The browser uploads directly to S3 using signed credentials from the org's Protected Endpoint configuration
  • 💬 When credentials are missing or invalid, the upload fails silently in the UI
3

Log in via LMA

Action

Open the License Management App (LMA) and log in to the affected org as a user with setup access. Protected Endpoint is a managed-package protected custom setting — it can only be written when logged in via LMA or from managed-package code.

Expected Result

You are logged into the target org with sufficient privileges to edit Custom Settings.

Talking Points
  • 💬 Direct org login without LMA cannot edit Protected Endpoint records
  • 💬 This is why SIT may work but a refreshed PreProd sandbox does not — the S3 record was never re-seeded
4

Configure the S3 Protected Endpoint

Action

In Setup (Lightning), navigate to Custom Settings > Protected Endpoint. Check whether an S3 record exists. If missing, create one. If present but empty, populate the AccessKey and SecretKey fields with the correct S3 credentials. Contact the Kaptio platform team if you do not have the credential values — do not copy credentials from Jira tickets or Slack threads.

Expected Result

An S3 Protected Endpoint record exists with valid AccessKey and SecretKey values.

Talking Points
  • 💬 Compare against a working environment (e.g. SIT) to confirm the record exists and is populated
  • 💬 Never document or share credential values in enablement content, tickets, or Slack
5

Verify the fix

Action

Return to Image Library and upload a test image. Confirm the upload completes without error and the image appears in the library.

Expected Result

Image uploads successfully. The new image is visible in Image Library and can be assigned to content or templates.

Talking Points
  • 💬 Also verify uploads from the Service Content tab if that was the original report path
  • 💬 If upload still fails, check the org's Kaptio package version — Hawaii 22.12.10+ includes S3 upload fixes (CEE-537 / KHELP-12434)

Success Criteria

  • ✓ S3 Protected Endpoint record exists and is populated in the affected org
  • ✓ Image Library upload completes without the generic 'Error' message
  • ✓ Uploaded image is visible in Image Library and usable in templates or content

Troubleshooting

❌ S3 record exists but upload still fails with 403
Solution: Verify the AccessKey and SecretKey values are correct and not expired. Compare with a working environment. Check package version is Hawaii 22.12.10 or later.
❌ Cannot edit Protected Endpoint without LMA
Solution: Protected Endpoint is a managed-package protected setting. You must log in via LMA. Alternatively, a Kaptio developer can trigger endpoint seeding via EndpointsService.createProtectedEndpoints() or PostInstallClass.doInstall from managed-package code.
❌ Upload works in SIT but not in PreProd after sandbox refresh
Solution: Sandbox refresh/clone does not carry Protected Endpoint values. Re-configure the S3 record in the refreshed org. Add image upload verification to your post-sandbox refresh checklist.
❌ File appears valid but upload fails
Solution: Confirm the file is a true PNG, JPEG, or GIF — not a WebP or other format renamed with a .png extension. Maximum file size is 20 MB.

Overview

When users upload images via Image Library — from Channel Templates, Service Content tabs, or the content editor — a generic “Error” message with no explanation usually means the S3 Protected Endpoint is missing or misconfigured in that Salesforce org.

This is an internal reference for implementation and support teams. It is not customer-facing documentation.

Where This Appears

Entry PointPath
Templates Image LibraryChannel > Templates > Image Library > Upload Image
Service ContentService record > Content tab > Upload Image
Content EditorImage Library while editing a content record

All paths use the same S3 upload mechanism.

Why It Happens

Image uploads in Kaptio work by having the browser POST directly to AWS S3 (kaptiotravel.s3.amazonaws.com) using signed credentials stored in the org’s Protected Endpoint custom setting (ProtectedEndpoint__c).

When the S3 record is missing or has empty/invalid credentials:

  1. The platform cannot generate valid signed upload URLs
  2. The browser POST to S3 fails (typically HTTP 403)
  3. The UI shows a generic “Error” with no detail

This is especially common after sandbox refresh or clone. Protected Endpoint values are not copied during refresh, so an org that worked in SIT may fail in a freshly refreshed PreProd.

Who Fixes It

A Kaptio team member with LMA access to the affected org. Customer users cannot fix this themselves — Protected Endpoint is a managed-package protected setting.

Fix Procedure

Step 1: Log in via LMA

Open the License Management App and log in to the affected org.

Step 2: Navigate to Protected Endpoint

Setup (Lightning) > Custom Settings > Protected Endpoint > Manage

Step 3: Configure the S3 record

  • If no S3 record exists, create one
  • Populate AccessKey and SecretKey with the correct S3 credentials
  • Obtain credential values from the Kaptio platform team — do not copy from Jira comments or Slack history

Step 4: Verify

Upload a test image via Image Library. Confirm it completes without error.

Alternative: Endpoint Seeding via Code

If LMA access is not available, a developer with managed-package context can trigger endpoint creation:

// Trigger default endpoint seeding (includes S3)
KaptioTravel.ServiceCall.execute('PostInstallClass.doInstall', new Map<String, Object>{
    'fromVersion' => new Map<String, Integer>{'major' => 1, 'minor' => 0, 'patch' => 0},
    'toVersion' => new Map<String, Integer>{'major' => 1, 'minor' => 0, 'patch' => 1},
    'notificationTo' => new List<String>{'your-email@example.com'},
    'throwException' => false
});

This creates all default Protected Endpoint records, not just S3. Use when multiple endpoints are missing after a fresh install or sandbox refresh.

Post-Sandbox Refresh Checklist

After any sandbox refresh or clone, verify:

  • Protected Endpoint > S3 record exists and is populated
  • Image Library upload succeeds (test with a small PNG)
  • Kaptio package version matches the target environment (Hawaii 22.12.10+ recommended)

Known Incidents

DateCustomer / OrgResolution
Nov 2025Belmond SITS3 Protected Endpoint configured via LMA (ST-2279)
Jul 2026Belmond PreProdSame fix — S3 record missing after sandbox refresh
Back to Gallery