Uploading an image with JSON:API; getting "Access denied" I'm attempting to upload an image with JSON:API.
I have added an Image field (not a media field) to the user entity.
In Postman, I get a session cookie for testing.
Then, in accordance with Flow 2 in the JSON:API upload file documentation, I configure my request:

I added image data as a binary to the request body.
However, when I send the request, I get the following error:
    &quot;title&quot;: &quot;Forbidden&quot;,
    &quot;status&quot;: &quot;403&quot;,
    &quot;detail&quot;: &quot;The current user is not permitted to upload a file for this field. The 'administer users' permission is required.&quot;,

I don't know why it is saying I need administer users permission.
When I log in as the same (authenticated, non-admin) user and then go to the user edit page, I can edit the image field (save a new image, remove the existing image) without any problem.  So why am I getting a permissions error in JSON:API?  I thought JSON:API permissions were supposed to be exactly the same as in the Drupal UI.
I wasn't able to get it working with Flow 2 in the docs; I kept getting a Needs &quot;administer users&quot; permission error (which is incorrect; users have permission to edit the field).
So instead, I used Flow 1:
POST /jsonapi/node/article/{uuid}/field_image HTTP/1.1
Content-Type: application/octet-stream
Accept: application/vnd.api+json
Content-Disposition: file; filename=&quot;filename.jpg&quot;

[… binary file data …]

This requires the user to already be created, which is OK for my user case, but may not be the case for everyone.
Additional notes

I had to turn off the popular Filefield Paths module for my image field because it breaks JSON:API.

I had to uncheck Alt field required in the image field settings; if you leave the alt field required, you get this nasty error:
  &quot;detail&quot;: &quot;The controller result claims to be providing relevant cache metadata, but leaked metadata was detected. Please ensure you are not rendering content too early. Returned object class: Drupal\\Core\\Cache\\CacheableResponse.&quot;,