Set media permissions
Decide who can view a piece of vault media, and get back the id you attach to a message.
Decide who can view a piece of vault media, and get back the id you attach to a message.
Fansly only. This wraps the media in a gated accountMedia object; the returned content_id is what a message attachment references. The media_id in the path is not attachable on its own — attaching it sends a message with nothing in it, and on a PPV the fan pays for an empty unlock.
Gates combine, and unlocking is an OR. Setting both price and require_subscription offers the fan two ways in — "pay $10" or "subscribe to a tier" — and satisfying either one grants access. Setting nothing makes the media free.
The audience nests: everyone → follow → subscribe → purchase. A subscriber is already a follower, so require the lowest gate you actually want.
whitelist grants named fans access regardless of the gate. Fansly auto-whitelists a DM's recipient, which is why a fan can always open what you send them even when the media is paid.
Requires writes to be enabled for the account.
Authorization
apiKey Your CRM panel API key
In: header
Path Parameters
Creator account ID of the connected account (OnlyFans or Fansly). Use GET /accounts to list connected accounts and their IDs.
The media id from POST /accounts/{of_user_id}/media or GET /accounts/{of_user_id}/vault/media.
Header Parameters
Proxy URL — HTTP or SOCKS5 (e.g. http://user:pass@host:port or socks5://user:pass@host:port). Optional on post-connection routes, where it overrides the proxy saved at login time. Required on the connection routes (POST /accounts/login, POST /accounts/login/cookies, POST /accounts/login/verify-otp) for OnlyFans accounts; optional for Fansly.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/accounts/string/media/string/permissions" \ -H "Content-Type: application/json" \ -d '{}'{ "success": true, "content_id": "string", "media": [ {} ]}