diff --git a/maubot/management/api/client.py b/maubot/management/api/client.py
index 872c965..051f9be 100644
--- a/maubot/management/api/client.py
+++ b/maubot/management/api/client.py
@@ -127,3 +127,16 @@ async def delete_client(request: web.Request) -> web.Response:
         await client.stop()
     client.delete()
     return resp.deleted
+
+
+@routes.post("/client/{id}/avatar")
+async def upload_avatar(request: web.Request) -> web.Response:
+    user_id = request.match_info.get("id", None)
+    client = Client.get(user_id, None)
+    if not client:
+        return resp.client_not_found
+    content = await request.read()
+    return web.json_response({
+        "content_uri": await client.client.upload_media(
+            content, request.headers.get("Content-Type", None)),
+    })
diff --git a/maubot/management/api/spec.yaml b/maubot/management/api/spec.yaml
index efe759e..af93a65 100644
--- a/maubot/management/api/spec.yaml
+++ b/maubot/management/api/spec.yaml
@@ -93,6 +93,13 @@ paths:
         schema:
           type: boolean
           default: false
+      requestBody:
+        content:
+          application/zip:
+            schema:
+              type: string
+              format: binary
+              example: The plugin maubot archive (.mbp)
       responses:
         200:
           description: Plugin uploaded and replaced current version successfully
@@ -111,14 +118,7 @@ paths:
         401:
           $ref: '#/components/responses/Unauthorized'
         409:
-          description: Plugin
-      requestBody:
-        content:
-          application/zip:
-            schema:
-              type: string
-              format: binary
-              example: The plugin maubot archive (.mbp)
+          description: Plugin already exists and allow_override was not specified.
   '/plugin/{id}':
     parameters:
     - name: id
@@ -169,6 +169,13 @@ paths:
         doesn't match the ID in the path. If the plugin already
         exists, enabled instances will be restarted.
       tags: [Plugins]
+      requestBody:
+        content:
+          application/zip:
+            schema:
+              type: string
+              format: binary
+              example: The plugin maubot archive (.mbp)
       responses:
         200:
           description: Plugin uploaded and replaced current version successfully
@@ -186,13 +193,6 @@ paths:
           $ref: '#/components/responses/BadRequest'
         401:
           $ref: '#/components/responses/Unauthorized'
-      requestBody:
-        content:
-          application/zip:
-            schema:
-              type: string
-              format: binary
-              example: The plugin maubot archive (.mbp)
   /plugin/{id}/reload:
     parameters:
     - name: id
@@ -399,6 +399,45 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/Error'
+  '/client/{id}/avatar':
+    parameters:
+    - name: id
+      in: path
+      description: The Matrix user ID of the client to get
+      required: true
+      schema:
+        type: string
+    post:
+      operationId: upload_avatar
+      summary: Upload a profile picture for a bot
+      tags: [Clients]
+      requestBody:
+        content:
+          image/png:
+            schema:
+              type: string
+              format: binary
+              example: The avatar to upload
+          image/jpeg:
+            schema:
+              type: string
+              format: binary
+              example: The avatar to upload
+      responses:
+        200:
+          description: The avatar was uploaded successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  content_uri:
+                    type: string
+                    description: The MXC URI of the uploaded avatar
+        400:
+          $ref: '#/components/responses/BadRequest'
+        401:
+          $ref: '#/components/responses/Unauthorized'
 
 components:
   responses: