Tenant Logos

A tenant can carry a logo, shown beside its name in the tenant list and on its detail page. You supply a URL; Mantis fetches the image once and serves it from its own origin thereafter.

Why the image is copied

Browsers are not allowed to load images from arbitrary hosts. The Content-Security-Policy Lens ships permits images only from Mantis itself, so a logo referenced directly at https://example.com/logo.png would never render — it would be blocked before the request left the browser.

Copying the image once removes that problem, and removes the dependency on a third-party host staying reachable every time somebody opens the page.

Setting a logo

Set Logo URL when creating or editing a tenant. On save, Mantis fetches the image and stores it. If the fetch fails, the save is rejected with the reason — a URL that cannot become a working logo is not stored, because the result would be a tenant whose logo silently never appears.

Accepted sources:


Schemes	`https` and `http`
Formats	PNG, JPEG, WebP
Size	up to 1 MB
Hosts	any reachable host, including your own internal network

Internal hosts are supported deliberately: serving a logo from a machine inside your network is a normal on-prem arrangement. The one exception is cloud instance-metadata addresses such as 169.254.169.254, which are never a valid image host and are refused.

SVG is not accepted. An SVG can carry script, and serving one from Mantis’s own origin would let that script run with Mantis’s privileges. Convert vector artwork to PNG.

The format is determined by inspecting the image itself, not by the file extension or the server’s declared content type, so a mislabelled file is rejected rather than stored.

The copy is a snapshot

The image is fetched when the URL is saved. Replacing the artwork at the source does not change what Mantis serves.

Use Refresh logo on the tenant detail page to fetch it again. If that fetch fails — the host is down, the file has moved — the existing logo is kept. Losing a working logo because a server blinked would be worse than showing a slightly old one.

There is no background re-fetch. A scheduled job reaching out to third-party hosts is a standing outbound-traffic surface and fails quietly; refreshing stays something you ask for.

Removing a logo

Clear the Logo URL field. The stored copy is removed with it, and the tenant falls back to its initial.