geovisio 2.10.0__tar.gz → 2.12.0__tar.gz

{geovisio-2.10.0 → geovisio-2.12.0}/.dockerignore

@@ -11,8 +11,8 @@
 !/geovisio/**/*.pot
 !/docker/docker-entrypoint.sh
 !/images/*
-!/migrations/*.sql
-!/migrations/*.py
-!/migrations/data/*.json
+!/geovisio/migrations/*.sql
+!/geovisio/migrations/*.py
+!/geovisio/migrations/data/*.json
 
 /**/__pycache__

{geovisio-2.10.0 → geovisio-2.12.0}/.gitignore

@@ -1,5 +1,6 @@
 pictures
 *.env
+!example.env
 *.log
 picfs
 env
@@ -7,7 +8,6 @@ env
 instance
 __pycache__
 config.py
-docker/models/
 .vscode/
 site/
 *.mo

{geovisio-2.10.0 → geovisio-2.12.0}/.gitlab-ci.yml

@@ -19,9 +19,9 @@ code-fmt:
   stage: test
   only:
       - merge_requests
-  image: python:3.10-alpine
+  image: python:3.13-alpine
   script:
-    - pip install black
+    - pip install --group format
     - black --fast --check .
 
 test-in-docker:
@@ -67,7 +67,7 @@ test-in-docker:
         --network=host
         --volume ./tests:/opt/geovisio/tests
         $TMP_CI_IMAGE
-        -c 'pip install -e .[dev] && /home/geovisio/.local/bin/pytest -m "not skipci"'
+        -c 'pip install --upgrade pip && pip install -e . --group dev && /home/geovisio/.local/bin/pytest -m "not skipci"'
   after_script:
     - docker rmi $TMP_CI_IMAGE || true # accept failure, as image creation can fail
 
@@ -79,7 +79,7 @@ test:
     - when: on_success
 
   stage: test
-  image: python:3.10
+  image: python:3.13
   services:
       - postgis/postgis:15-3.4
   variables:
@@ -95,10 +95,17 @@ test:
   script:
       - apt update && apt install -y gettext
       - mkdir -p /tmp/geovisio_test/tmp /tmp/geovisio_test/derivates /tmp/geovisio_test/permanent
-      - pip install -e .[dev]
+      - pip install -e . --group dev
       - make i18n-po2code
       - pytest -vv -m "not skipci"
 
+dependencies-lock:
+  stage: test
+  image: ghcr.io/astral-sh/uv:0.9.2-python3.11-bookworm-slim
+  script:
+    # enforce that the lock file is up to date.
+    # Updating this lock file is important to ensure the production servers will use the right versions
+    - uv lock --check
 
 publish-develop:
   rules:
@@ -142,7 +149,7 @@ publish-develop:
       --network=host
       --volume ./tests:/opt/geovisio/tests
       "$DOCKER_IMAGE_NAME:develop"
-      -c 'pip install -e .[dev] && /home/geovisio/.local/bin/pytest -vv -m "not skipci"'
+      -c 'pip install --upgrade pip && pip install -e . --group dev && /home/geovisio/.local/bin/pytest -vv -m "not skipci"'
 
     # publish image to dockerhub with the develop tag
     - docker push "$DOCKER_IMAGE_NAME:develop"
@@ -188,7 +195,7 @@ publish-tag-and-latest:
       --network=host
       --volume ./tests:/opt/geovisio/tests
       "$DOCKER_IMAGE_NAME:latest"
-      -c 'pip install -e .[dev] && ~/.local/bin/pytest -vv -m "not skipci"'
+      -c 'pip install --upgrade pip && pip install -e . --group dev && ~/.local/bin/pytest -vv -m "not skipci"'
 
     # publish image to dockerhub
     - docker push $DOCKER_IMAGE_NAME:$CI_COMMIT_REF_NAME
@@ -198,9 +205,9 @@ publish-on-pypi:
   only:
     - tags
   stage: deploy
-  image: python:3.10
+  image: python:3.13
   script:
     - apt update && apt install -y gettext
-    - pip install .[build]
+    - pip install --group build
     - make i18n-po2code
     - flit publish # use [flit](https://flit.pypa.io/) and FLIT_USERNAME/FLIT_PASSWORD env var

geovisio-2.12.0/.pre-commit-config.yaml

@@ -0,0 +1,12 @@
+repos:
+-   repo: https://github.com/psf/black
+    rev: 25.1.0
+    hooks:
+    -   id: black
+
+-   repo: https://github.com/astral-sh/uv-pre-commit
+    # ensure the uv.lock file is up to date, it's important to update it when a dependency is updated
+    # by running `uv lock`
+    rev: 0.9.2
+    hooks:
+      - id: uv-lock

geovisio-2.12.0/.python-version

@@ -0,0 +1 @@
+3.13

{geovisio-2.10.0 → geovisio-2.12.0}/CHANGELOG.md

@@ -9,6 +9,53 @@ Before _1.6.0_, [Viewer](https://gitlab.com/panoramax/clients/web-viewer) was em
 
 ## [Unreleased]
 
+## [2.12.0] - 2025-02-04
+
+⚠️ Breaking change to install development dependencies ⚠️
+
+To install development dependencies, you need to run `pip install -e . --group dev` instead of `pip install -e .[dev]`.
+
+### Added
+
+- Add HATEOAS links to show permissions on collections/items/upload_sets. See https://docs.panoramax.fr/backend/api/api/#permissions for more details.
+- Add a `panoramax_backend` command to the Python package, as an alias to the `flask --app geovisio` command.
+
+### Fixed
+
+- Fix bug on python3.13 where running a command could hang with logs like "couldn't stop thread 'pool-1-worker-0' within 5.0 seconds"
+- Nearby picture (`related` link type) was not returned if picture heading was greater than current picture one.
+
+### Changed
+
+- The `migrations` folder has now been moved to the root of the package, so it is available when installing the package using pypi.
+- The default web pages are more up-to-date (viewer v4, Panoramax logos, links to docs.panoramax.fr)
+- The python dependencies are now managed using [dependency groups](https://flit.pypa.io/en/latest/pyproject_toml.html#dependency-groups) instead of the `[project.optional-dependencies]` section. So you need to install the dependencies using `pip install -e . --group dev` instead of `pip install -e .[dev]`, and the `dev`/`format`/`docs`/`build` groups are available, but not part of the released package. This also means that `pip` minimal version is now `25.1` (only for development). Run `pip install --upgrade pip` to upgrade your pip version.
+- Update dependencies to support Python 3.14 🥧
+
+## [2.11.0] - 2025-12-12
+
+### Added
+
+- A way to delete an annotation (via `DELETE /api/annotations/<uuid:annotationId>` or `DELETE /api/collections/<uuid:collectionId>/items/<uuid:itemId>/annotations/<uuid:annotationId>`). Anyone authenticated can delete an annotation (and the changes are tracked in the history).
+- Added a new way to restrict who can view a sequence/picture, instead of the old `hidden` mechanism, we can now set a `visibility` field at the sequence/picture/upload_set level. This parameter can have (for the moment) the values:
+  - `anyone`: the sequence is visible to anyone
+  - `owner-only`: the sequence is visible to the owner and administrator only
+  - `logged-only`: the sequence is visible to logged users only
+    A default `visibility` can also be set at the `account` or instance level.
+- Change the permissions, now an instance administrator (and account that has the `admin` role), can see, edit and delete all sequences and pictures.
+- Display the collection semantics in the `/api/collections/<uuid:collectionId>/items` endpoint, to make it easier to be crawled by the metacatalog.
+- Add a new search capability with the query `/api/search?filter=semantics IS NOT NULL` to search for all items with some semantics (be it linked to the picture, its sequence or an annotation in the picture).
+- Add a way to know that the terms of service have been updated, and the users have read the latest changes.
+- Add an admin cli command to delete all the pictures of a user (`user <ACCOUNT_ID_OR_NAME> --delete-data`).
+
+### Changed
+
+- ⚠️ API breaking change ⚠️: we do not support anymore the `status` filter (and especially the `status='deleted'` filter) when querying the sequences, since it could leak information about some sequences with restricted visibility (since we treated those sequences as `deleted` to tell potential crawlers not to consider them anymore). This parameter is now replaced by a new `show_deleted` boolean parameter that makes the API return collections with only an `id` and a `deleted` status, without additional fields. Note that thus, when using this parameter, the response does no longer follow the STAC format for deleted collections.
+
+### Fixed
+
+- Use fully qualified path for the pictures_grid materialized view to avoid the `relation "pictures" does not exist` issue on some server.
+
 ## [2.10.0] - 2025-08-27
 
 ### Added
@@ -17,12 +64,13 @@ Before _1.6.0_, [Viewer](https://gitlab.com/panoramax/clients/web-viewer) was em
 - Add an `updated` field in all the items's responses.
 - Add an `sortby` parameter in search to sort the results (and it can use the new `updated` field).
 - Add a way to generate a new token for the current user (via `POST /api/users/me/tokens`).
-- Added route aliases to get annotations. 
-  * The route `/api/annotations/<uuid:annotationId>` is now an alias of `/api/collections/<uuid:collectionId>/items/<uuid:itemId>/annotations/<uuid:annotationId>`
-  * The route `/api/picture/<uuid:pictureId>` is now an alias of `/api/collections/<uuid:collectionId>/items/<uuid:itemId>`
-  * The route to create an annotation `/api/picture/<uuid:pictureId>/annotations` is now an alias of `/api/collections/<uuid:collectionId>/items/<uuid:itemId>/annotations`
+- Added route aliases to get annotations.
+  - The route `/api/annotations/<uuid:annotationId>` is now an alias of `/api/collections/<uuid:collectionId>/items/<uuid:itemId>/annotations/<uuid:annotationId>`
+  - The route `/api/picture/<uuid:pictureId>` is now an alias of `/api/collections/<uuid:collectionId>/items/<uuid:itemId>`
+  - The route to create an annotation `/api/picture/<uuid:pictureId>/annotations` is now an alias of `/api/collections/<uuid:collectionId>/items/<uuid:itemId>/annotations`
 - Add a way to attach semantic tags to upload sets. Those tags will be transferred to all the collections associated to the upload set. This makes it possible to add semantic tags directly at the upload, without waiting for all the associated collections to be created.
 - Add a `relative_heading` parameter to the `/api/upload_sets/:id` route (for `POST` and `PATCH`), to update the relative heading of the upload set. If a `relative_heading` is set on the upload set, it will be applied when computeing the heading of all the associated collections.
+- Add a `/api/queryables` route to list the queryables for search and `/api/collections/queryables` to list the queryables for collection search.
 
 ### Changed
 
@@ -678,7 +726,9 @@ FLASK_APP="src" flask process-sequences
 - Viewer based on Photo Sphere Viewer automatically calling API to search and retrieve pictures
 - Dockerfile for easy server setup
 
-[Unreleased]: https://gitlab.com/panoramax/server/api/-/compare/2.10.0...develop
+[Unreleased]: https://gitlab.com/panoramax/server/api/-/compare/2.12.0...develop
+[2.12.0]: https://gitlab.com/panoramax/server/api/-/compare/2.11.0...2.12.0
+[2.11.0]: https://gitlab.com/panoramax/server/api/-/compare/2.10.0...2.11.0
 [2.10.0]: https://gitlab.com/panoramax/server/api/-/compare/2.9.0...2.10.0
 [2.9.0]: https://gitlab.com/panoramax/server/api/-/compare/2.8.1...2.9.0
 [2.8.1]: https://gitlab.com/panoramax/server/api/-/compare/2.8.0...2.8.1

{geovisio-2.10.0 → geovisio-2.12.0}/Dockerfile

@@ -5,7 +5,7 @@ LABEL org.opencontainers.image.title="GeoVisio API"
 LABEL org.opencontainers.image.description="Panoramax is a digital resource for sharing and using field photos. GeoVisio API is the backend part of the ecosystem."
 LABEL org.opencontainers.image.authors="Adrien PAVIE <panieravide@riseup.net>"
 LABEL org.opencontainers.image.source="https://gitlab.com/panoramax/server/api.git"
-LABEL org.opencontainers.image.documentation="https://docs.panoramax.fr/api/"
+LABEL org.opencontainers.image.documentation="https://docs.panoramax.fr/backend/"
 LABEL org.opencontainers.image.vendor="Panoramax"
 LABEL org.opencontainers.image.licenses="MIT"
 LABEL org.opencontainers.image.url="https://panoramax.fr/"
@@ -14,7 +14,7 @@ LABEL org.opencontainers.image.url="https://panoramax.fr/"
 # and create a `geovisio` user, to run the app as non root user
 RUN apt update \
     && apt install -y git gettext make \
-    && pip install waitress gunicorn Babel \
+    && pip install waitress Babel \
     && rm -rf /var/lib/apt/lists/* \
     && mkdir -p /opt/geovisio /data/geovisio \
     && groupadd --gid 1000 geovisio \
@@ -33,7 +33,6 @@ RUN pip install -e . --user
 COPY ./images ./images/
 COPY ./docker/docker-entrypoint.sh ./
 COPY ./geovisio ./geovisio
-COPY ./migrations ./migrations
 COPY ./Makefile ./
 
 # Generate i18n compiled files
@@ -46,6 +45,7 @@ ARG GIT_DESCRIBE
 LABEL org.opencontainers.image.revision=$GIT_DESCRIBE
 
 # Environment variables
+ENV PATH="~/.local/bin/:$PATH"
 ENV FLASK_APP=geovisio
 ENV FS_URL="/data/geovisio"
 ENV API_GIT_VERSION=$GIT_DESCRIBE

{geovisio-2.10.0 → geovisio-2.12.0}/PKG-INFO

@@ -1,14 +1,14 @@
 Metadata-Version: 2.4
 Name: geovisio
-Version: 2.10.0
+Version: 2.12.0
 Summary: GeoVisio API - Main
 Author-email: Adrien PAVIE <panieravide@riseup.net>, Antoine Desbordes <antoine.desbordes@gmail.com>
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Classifier: License :: OSI Approved :: MIT License
 License-File: LICENSE
-Requires-Dist: Flask ~= 3.1
-Requires-Dist: psycopg[pool] ~= 3.2
+Requires-Dist: Flask ~= 3.1.2
+Requires-Dist: psycopg[pool] ~= 3.3
 Requires-Dist: flasgger ~= 0.9.7
 Requires-Dist: Pillow ~= 11.1
 Requires-Dist: Flask-Cors ~= 6.0
@@ -17,45 +17,26 @@ Requires-Dist: fs-s3fs-forked ~= 1.1.4
 Requires-Dist: flask-compress ~= 1.14
 Requires-Dist: requests ~= 2.31
 Requires-Dist: yoyo-migrations ~= 9.0
-Requires-Dist: psycopg-binary ~= 3.2
-Requires-Dist: python-dotenv ~= 1.1
+Requires-Dist: psycopg-binary ~= 3.3
+Requires-Dist: python-dotenv ~= 1.2
 Requires-Dist: authlib ~= 1.6
 Requires-Dist: Flask-Executor ~= 1.0
-Requires-Dist: geopic-tag-reader[write-exif] ~= 1.8.0
+Requires-Dist: geopic-tag-reader[write-exif] ~= 1.8.2
 Requires-Dist: rfeed ~= 1.1.1
 Requires-Dist: sentry-sdk[flask] ~= 2.24
 Requires-Dist: pygeofilter[backend-native] ~= 0.3.1
 Requires-Dist: python-dateutil ~= 2.9.0
 Requires-Dist: tzdata ~= 2025.2
 Requires-Dist: croniter ~= 6.0.0
-Requires-Dist: pydantic ~= 2.11
+Requires-Dist: pydantic ~= 2.12
 Requires-Dist: pydantic-extra-types ~= 2.7
 Requires-Dist: flask-babel ~= 4.0.0
 Requires-Dist: geojson-pydantic ~= 2.0.0
 Requires-Dist: email-validator ~= 2.2.0
 Requires-Dist: multipart>=1.2.1
-Requires-Dist: flit ~= 3.9.0 ; extra == "build"
-Requires-Dist: coverage ~= 7.9 ; extra == "dev"
-Requires-Dist: protobuf ~= 5.26 ; extra == "dev"
-Requires-Dist: mapbox-vector-tile ~= 2.1 ; extra == "dev"
-Requires-Dist: pystac ~= 1.9 ; extra == "dev"
-Requires-Dist: pytest ~= 8.4 ; extra == "dev"
-Requires-Dist: pytest-datafiles ~= 3.0 ; extra == "dev"
-Requires-Dist: pyexiv2 ~= 2.15 ; extra == "dev"
-Requires-Dist: testcontainers ~= 4.10 ; extra == "dev"
-Requires-Dist: requests-mock ~= 1.11 ; extra == "dev"
-Requires-Dist: black ~= 25.1 ; extra == "dev"
-Requires-Dist: pre-commit ~= 4.2 ; extra == "dev"
-Requires-Dist: pyyaml ~= 6.0 ; extra == "dev"
-Requires-Dist: openapi-spec-validator ~= 0.7 ; extra == "dev"
-Requires-Dist: stac-api-validator ~= 0.6.4 ; extra == "dev"
-Requires-Dist: mkdocs-material ~= 9.6.14 ; extra == "docs"
-Requires-Dist: mkdocs-swagger-ui-tag ~= 0.7.1 ; extra == "docs"
+Requires-Dist: gunicorn ~= 23.0.0
 Project-URL: Home, https://gitlab.com/panoramax/server/api
 Project-URL: Source Code, https://gitlab.com/panoramax/server/api
-Provides-Extra: build
-Provides-Extra: dev
-Provides-Extra: docs
 
 # ![Panoramax](https://upload.wikimedia.org/wikipedia/commons/thumb/a/a9/Panoramax.svg/40px-Panoramax.svg.png) Panoramax
 

geovisio-2.12.0/bin/run_production_api.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+
+# script called by the Scalingo Procfile
+
+DB_CHECK_SCHEMA=false gunicorn --workers "${NB_API_WORKERS:-5}" --threads "${NB_API_THREADS:-4}" -b ":$PORT" 'geovisio:create_app()'

{geovisio-2.10.0 → geovisio-2.12.0}/docker/docker-compose-full.yml

@@ -57,7 +57,7 @@ services:
       - /bin/bash
       - -c
       - |
-        python3 -m flask user elysee --set-role admin --create
+        panoramax_backend user elysee --set-role admin --create
     depends_on:
       migrations:
         condition: service_completed_successfully

{geovisio-2.10.0 → geovisio-2.12.0}/docker/docker-entrypoint.sh

@@ -2,12 +2,12 @@
 
 usage() {
     echo "./docker-entrypoint.sh <COMMAND>: "
-    echo -e "\tThis script simplifies running GeoVisio backend in a certain mode"
+    echo -e "\tThis script simplifies running Panoramax backend in a certain mode"
     echo "Commands: "
     echo -e "\tapi (default): Starts web API for production on port 5000 by default"
     echo -e "\tdev-api: Starts web API for development on port 5000 by default"
     echo -e "\tpicture-worker: Starts an independant background worker to process pictures"
-    echo -e "\tcleanup: Cleans database and remove Geovisio derivated files (it doesn't delete your original pictures)"
+    echo -e "\tcleanup: Cleans database and remove Panoramax derivated files (it doesn't delete your original pictures)"
     echo -e "\tdb-upgrade: Upgrade the database schema"
     echo -e "\tdb-refresh: Refresh all materialized views in the database"
 }
@@ -23,7 +23,7 @@ case $command in
     python3 -m waitress --port 5000 --threads=${NB_API_THREADS:-4} --call 'geovisio:create_app'
     ;;
 "gunicorn-api")
-    gunicorn --workers ${NB_API_WORKERS:-5} --threads ${NB_API_THREADS:-4} -b :5000 'geovisio:create_app()'
+    python3 -m gunicorn --workers ${NB_API_WORKERS:-5} --threads ${NB_API_THREADS:-4} -b :5000 'geovisio:create_app()'
     ;;
 "ssl-api")
     python3 -m waitress --port 5000 --threads=${NB_API_THREADS:-4} --url-scheme=https --trusted-proxy '*' --trusted-proxy-headers 'X-Forwarded-For X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto' --log-untrusted-proxy-headers --clear-untrusted-proxy-headers  --call 'geovisio:create_app'

{geovisio-2.10.0 → geovisio-2.12.0}/docker/full-keycloak-auth/docker-compose.yml

@@ -109,7 +109,7 @@ services:
       NB_API_THREADS: 10
       INFRA_NB_PROXIES: ${INFRA_NB_PROXIES:-1}
       # API SUMMARY regroup many metadata about the instance
-      # check the documentation on how translations are handled: https://docs.panoramax.fr/api/install/settings/#metadata
+      # check the documentation on how translations are handled: https://docs.panoramax.fr/backend/install/settings/#metadata
       API_SUMMARY: >-
         {
           "color": "#abcdef",

{geovisio-2.10.0 → geovisio-2.12.0}/docker/full-keycloak-auth/nginx.conf

@@ -25,6 +25,7 @@ http {
 		# We need to set X-Forwarded headers, so the API can use them to make nice internal links
 		proxy_set_header X-Real-IP $remote_addr;
 		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Host $host;
 
 		# Limit the files that can be sent to 100M
 		client_max_body_size  100M;
@@ -53,7 +54,6 @@ http {
             # add X-forward- headers for keycloak to know it's canonical host
             # force https
     	    proxy_set_header X-Forwarded-Proto https;
-            proxy_set_header X-Forwarded-Host $host;
 
 			proxy_redirect default;
 		}

{geovisio-2.10.0 → geovisio-2.12.0}/docker/full-osm-auth/docker-compose.yml

@@ -53,7 +53,7 @@ services:
       NB_API_THREADS: 10
       INFRA_NB_PROXIES: ${INFRA_NB_PROXIES:-1}
       # API SUMMARY regroup many metadata about the instance
-      # check the documentation on how translations are handled: https://docs.panoramax.fr/api/install/settings/#metadata
+      # check the documentation on how translations are handled: https://docs.panoramax.fr/backend/install/settings/#metadata
       API_SUMMARY: >-
         {
           "color": "#abcdef",

{geovisio-2.10.0 → geovisio-2.12.0}/docker/full-osm-auth/nginx.conf

@@ -21,6 +21,7 @@ http {
 		# We need to set X-Forwarded headers, so the API can use them to make nice internal links
 		proxy_set_header X-Real-IP $remote_addr;
 		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Host $host;
 
 		# Limit the files that can be sent to 100M
 		client_max_body_size  100M;

{geovisio-2.10.0 → geovisio-2.12.0}/docs/api/api.md

@@ -179,6 +179,55 @@ This calls needs to be logged, another token (or even the same one) can be used.
     http  -A bearer -a eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnZW92aXNpbyIsInN1YiI6ImVlNjQ5MjM1LWJmMTAtNGIwNC1hMDlhLTY0YjE2NjN DELETE https://my-panoramax.fr/api/users/me/tokens/ee649235-bf10-4b04-a09a-64b1663af6f8
     ```
 
+### ⚖️ Permissions
+
+The API checks permissions on each route, and returns a:
+
+* 401 if authentication is required
+* 403 error if the user is not allowed to access the route
+
+The API also adds HATEAOS links to show the permissions of the current user on the queried object. It might be handy for client to use those links to show what actions are allowed. It might, for example, be used to disable a delete button if the user cannot delete the object.
+
+This only works for access by ID (eg, in endpoints like `/api/collections/:id` and not `/api/collections` or `/api/search`) and only for authenticated calls (since no edit is possible without authentication).
+
+The links have a `method` attribute to define the HTTP method to use for this permission, and might have an `attributes` attribute for the `edit` links,to tell which fields can be patched by the user.
+
+Example:
+
+```js
+"links": [
+    ...
+        {
+            "rel": "edit",
+            "type": "application/json",
+            "method": "PATCH", // <-- HTTP verb to use to call the endpoint
+            "href": "https://my_panoramax.org/api/collections/some_id", // <-- api endpoint
+            "attributes": ["relative_heading", "semantics", "sortby", "title", "visibility"], // <-- the user can patch those fields
+        },
+    ]
+```
+
+The `rel` attribute should be used to identify the permission.
+
+#### Links on sequences (collections)
+
+The available `rel` links are:
+
+* `edit` to patch the collection. An additional field `attributes` is provided to tell which fields can be patched by the user.
+* `delete` to delete the collection
+
+#### Links on upload_sets
+
+* `edit` to patch the upload_set. An additional field `attributes` is provided to tell which fields can be patched by the user.
+* `delete` to delete the upload_set
+* `add_files` to add files to the upload_set
+* `complete` to complete the upload_set
+
+#### Links on pictures (items)
+
+* `edit` to patch the picture. An additional field `attributes` is provided to tell which fields can be patched by the user.
+* `delete` to delete the picture
+* `add_annotation` to add an annotation on the picture
 
 ## :octicons-upload-16: Upload
 
@@ -322,4 +371,4 @@ Enjoy your brand-new uploaded pictures by browsing the map or querying the assoc
 
     ```bash
     http https://my-panoramax.fr/api/upload_sets/60d94628-8098-42cc-b684-ffb9aa9d35a7
-    ```
+    ```