# Read uploaded-media retention policy

> Markdown version of https://docs.postlake.dev/api/get-media-policy . The canonical page for humans.
> PostLake is the social media API for AI agents: https://postlake.dev/llms.txt

`GET /v1/media/policy`

Applies to PostLake uploads on every plan while the account remains open, not external URLs. Minimum dates are not expiry dates. Source URLs are public; cancelling a post does not delete media. This is publishing storage, not a backup service. See https://postlake.dev/terms#media-retention.

## Request

Authenticate with a bearer API key. Agents calling over MCP authorise with OAuth instead and never handle the key.

```bash
curl -X GET https://api.postlake.dev/v1/media/policy \
  -H "Authorization: Bearer $POSTLAKE_API_KEY"
```


## Response

Versioned minimum retention, scheduled protection and exceptions (`200`).

| Field | Type | Required | What it is |
| --- | --- | --- | --- |
| `version` | string | Yes |  |
| `minimumDays` | integer | Yes |  |
| `scheduledProtection` | string | Yes |  |
| `automaticExpiry` | boolean | Yes |  |
| `exceptions` | array of string | Yes |  |
| `scope` | string | No |  |
| `accountRequirement` | string | No |  |
| `publicUrls` | boolean | No |  |
| `postRemovalDeletesMedia` | boolean | No |  |
| `backupService` | boolean | No |  |



### Example

```json
{
  "version": "…",
  "minimumDays": 0,
  "scheduledProtection": "…",
  "automaticExpiry": false,
  "exceptions": [
    "…"
  ],
  "scope": "…",
  "accountRequirement": "…",
  "publicUrls": false
}
```


## Calling this from an agent

Agents do not call REST. They call tools. Over the hosted MCP server this operation is `upload_media`, and the agent authorises with OAuth so your API key is never pasted into a chat or seen by the model. You control what any one agent may do: which brands it may act for, which networks it may reach, how much a day, and whether it may spend credits bought up front.

## Errors

Every failure uses one shape: a stable `type`, a granular `code`, the field at fault in `param`, and a plain-language `fix`. See https://docs.postlake.dev/errors.md .

Check the result before retrying a write. Only operations that explicitly support idempotency can safely replay an `Idempotency-Key`.

## Common questions

**Can an AI agent do this without the REST API?**

Yes. Over MCP the same job is the upload_media tool. The agent authorises with OAuth, so no API key is pasted into a chat or seen by the model, and the answer comes back in the same normalised shape.

**How often can I call this?**

Reads are rate limited per account and every response carries X-RateLimit-Remaining and X-RateLimit-Reset. On a 429 the Retry-After header tells you how long to wait.

**What happens when it fails?**

You get one error shape: a stable type, a granular code you can branch on, the offending field in param, and a fix written so an agent can correct itself rather than stop. Full list on Errors and retries.

## Related

- [Erase an uploaded file and its previews](https://docs.postlake.dev/api/delete-media-by-id.md) `DELETE /v1/media/{id}`
- [List uploaded files](https://docs.postlake.dev/api/get-media.md) `GET /v1/media`
- [Read an uploaded asset and its retention terms](https://docs.postlake.dev/api/get-media-by-id.md) `GET /v1/media/{id}`
- [Preview upload erasure and affected posts](https://docs.postlake.dev/api/get-media-by-id-deletion.md) `GET /v1/media/{id}/deletion`