---
{
  "id": "platform.slide.images-and-external-sources",
  "topic": "slide",
  "title": "Managed and external images in Slide content",
  "locale": "en",
  "version": "2026-07-25",
  "summary": "Version 2 image elements require exactly one managed asset or safe external HTTPS source, with binding authorization and explicit unsafe-URL rejection.",
  "content": "Every version 2 `image` element requires an `imageSource` object. A managed source is `{\"type\":\"managed\",\"imageAssetId\":\"<uuid>\"}`. An external source is `{\"type\":\"external\",\"externalImageUrl\":\"https://...\"}`. Identity fields belong inside that object, and the modes are exclusive: do not mix fields or use legacy top-level `src` or `url` in version 2. Version 1 retains legacy compatibility and may coexist with canonical image data during migration; all new content should use version 2 plus `imageSource`.\n\nManaged assets are authorized and bound during add or update. `imageAssetId cannot be bound to this slide` means the asset does not exist for this owner or is not owned by them; it is not a transient retry signal. When content changes or a slide or deck is deleted, corresponding bindings are released. Do not promise any image lifecycle beyond those bindings. Duplicating a slide recreates bindings for copied content.\n\nExternal sources must be safe HTTP or HTTPS URLs under runtime policy. Inline `data:` URLs, `blob:` URLs, embedded credentials, and internal managed-asset content endpoints are rejected. Avoid downloading or rewriting an external source on the user's behalf unless a separate authorized workflow explicitly does so. Preserve the exact typed validation or permission error, because the registry and runtime policy remain authoritative.\n",
  "aliases": [
    "presentation image",
    "imageSource",
    "managed image asset",
    "external image URL",
    "image binding",
    "unsafe image URL"
  ],
  "tags": [
    "slide",
    "image",
    "managed-asset",
    "external-url",
    "safety"
  ],
  "relatedActions": [
    "arinova.slide.add_slide",
    "arinova.slide.update_slide",
    "arinova.slide.delete_slide",
    "arinova.slide.duplicate_slide"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/slide/images-and-external-sources/"
}
---

Every version 2 `image` element requires an `imageSource` object. A managed source is `{"type":"managed","imageAssetId":"<uuid>"}`. An external source is `{"type":"external","externalImageUrl":"https://..."}`. Identity fields belong inside that object, and the modes are exclusive: do not mix fields or use legacy top-level `src` or `url` in version 2. Version 1 retains legacy compatibility and may coexist with canonical image data during migration; all new content should use version 2 plus `imageSource`.

Managed assets are authorized and bound during add or update. `imageAssetId cannot be bound to this slide` means the asset does not exist for this owner or is not owned by them; it is not a transient retry signal. When content changes or a slide or deck is deleted, corresponding bindings are released. Do not promise any image lifecycle beyond those bindings. Duplicating a slide recreates bindings for copied content.

External sources must be safe HTTP or HTTPS URLs under runtime policy. Inline `data:` URLs, `blob:` URLs, embedded credentials, and internal managed-asset content endpoints are rejected. Avoid downloading or rewriting an external source on the user's behalf unless a separate authorized workflow explicitly does so. Preserve the exact typed validation or permission error, because the registry and runtime policy remain authoritative.