Actually you're quite right, yeah. My feeling though is that in cases like this it doesn't really matter what the PUT really does behind the scene. For your API consumer it just changes the user's picture (in some cases from None to one). So yeah, PUT can both create and update in this case, but the consumer has no need to make the distinction between the two semantics.