We currently try to setup a sync for ActiveDirectory Pictures and Hipchat.
I (admin) created an API Token token with privilege “administer groups”
If I try to update my own profile with https://email@example.com/photo?auth_token=myauth everything works (base64 in the body of course).
If I try to update my colleagues picture I get a 403.
So no updating profiles as admin?
seems to be the real bug/feature?