The Only API docs
Content

Find vault media by MD5 (dedupe)

Deduplication / file→vault-item lookup. Given the MD5 of an original file, returns the matching vault media if that exact byte content was previously uploaded, or 404…

GET
/api2/v2/vault/media/hash

Deduplication / file→vault-item lookup. Given the MD5 of an original file, returns the matching vault media if that exact byte content was previously uploaded, or 404 Media Not Found if not.

This is the ONLY content-based way to correlate a local file with an existing vault item — OnlyFans stores no filename or hash on the media object. The hash is the MD5 of the original uploaded bytes: hashing a downloaded/CDN copy will NOT match (the served file differs from the original), and a file that was re-encoded/re-exported after upload will not match either. In that case, capture the media id at upload time and keep your own source → id map.

Response is wrapped in the passthrough envelope. OnlyFans only.

Guide: The two surfaces

X-API-Key<token>

Your CRM panel API key

In: header

Query Parameters

h*string

MD5 hex digest of the ORIGINAL uploaded file bytes. Note the parameter is h, not hash — this was documented as hash in error until 2026-08-06. For a single-part upload the S3 ETag returned by POST /accounts/{of_user_id}/media is exactly this MD5, so you can feed it straight back in.

size*integer

Size of the original file in bytes. OnlyFans' own client always sends this alongside h.

Header Parameters

user-id*string

Creator account ID of the account to act as (e.g. 509955039). Required — omitting it returns 400 user-id header is required. Use GET /accounts to list your connected accounts. On /api2/v2/* the account must be an OnlyFans account; Fansly accounts are rejected there.

X-Proxy?string

Proxy URL — HTTP or SOCKS5 (e.g. http://user:pass@host:port or socks5://user:pass@host:port). Optional on post-connection routes, where it overrides the proxy saved at login time. Required on the connection routes (POST /accounts/login, POST /accounts/login/cookies, POST /accounts/login/verify-otp) for OnlyFans accounts; optional for Fansly.

Response Body

application/json

curl -X GET "https://example.com/api2/v2/vault/media/hash?h=string&size=0" \  -H "user-id: 509955039"
{  "success": true,  "status_code": 0,  "data": {    "id": 0,    "type": "photo",    "createdAt": "2019-08-24T14:15:22Z",    "duration": 0,    "convertedToVideo": true,    "canView": true,    "isReady": true,    "hasError": true,    "hasPosts": true,    "hasCustomPreview": true,    "counters": {      "buyersCount": 0,      "likesCount": 0,      "tipsSumm": 0    },    "listStates": [      {        "id": 0,        "name": "string",        "hasMedia": true,        "canAddMedia": true      }    ],    "files": {      "full": {        "url": "string",        "width": 0,        "height": 0,        "size": 0      },      "preview": {        "url": "string",        "width": 0,        "height": 0      },      "thumb": {        "url": "string",        "width": 0,        "height": 0      },      "squarePreview": {        "url": "string",        "width": 0,        "height": 0      }    },    "videoSources": {      "property1": "string",      "property2": "string"    }  }}