API reference · Media
List uploaded files
GET /v1/media
Owner-scoped cursor pagination in descending media-ID order, not upload-time order. Deleted files are excluded; deleting files remain visible for retry. No post-history scan.
Request
Authenticate with a bearer API key. Agents calling over MCP authorise with OAuth instead and never handle the key.
curl -X GET https://api.postlake.dev/v1/media \
-H "Authorization: Bearer $POSTLAKE_API_KEY"Parameters
| Field | Type | Required | What it is |
|---|---|---|---|
before | string | No | Query string. next from the previous response |
limit | integer | No | Query string. |
Response
items and next (null at end) (200).
| Field | Type | Required | What it is |
|---|---|---|---|
items | array | No | |
next | string | No |
Example
{
"items": [
"…"
],
"next": "…"
}Paging
Pass limit (1 to 100, default 50) and the cursor returned by the previous page. A response with a null cursor is the last page. Every list endpoint pages the same way, so one helper covers all of them.
Limits
Reads are limited to 600 requests a minute per account. Every response carries X-RateLimit-Remaining and X-RateLimit-Reset, and a 429 includes Retry-After so a client can back off without guessing. Reads of network data (comments, followers, conversations) are metered in credits; reads of your own PostLake state are not.
Calling this from an agent
Agents do not call REST. They call tools. Over the hosted MCP server this operation is upload_media, and the agent authorises with OAuth so your API key is never pasted into a chat or seen by the model. The reply comes back in the same normalised shape you see above, which is what lets an agent reason about it without a per-network branch.
You control what any one agent may do with it: which brands it may act for, which networks it may reach, how much it may do in a day, and whether it may spend credits you bought up front. See the MCP server.
Errors
Every failure uses one shape: a stable type, a granular code, the field at fault in param, and a plain-language fix. An agent can act on it without a person reading the message. See Errors and retries.
Idempotency-Key.Common questions
Can an AI agent do this without the REST API?
Yes. Over MCP the same job is the upload_media tool. The agent authorises with OAuth, so no API key is pasted into a chat or seen by the model, and the answer comes back in the same normalised shape.
How often can I call this?
Reads are rate limited per account and every response carries X-RateLimit-Remaining and X-RateLimit-Reset. On a 429 the Retry-After header tells you how long to wait.
What happens when it fails?
You get one error shape: a stable type, a granular code you can branch on, the offending field in param, and a fix written so an agent can correct itself rather than stop. Full list on Errors and retries.