Get vault media
List vault media items. This is how you obtain the integer media IDs referenced by post creation, story creation, and messages.
List vault media items. This is how you obtain the integer media IDs referenced by post creation, story creation, and messages.
Uploading new media: use POST /accounts/{of_user_id}/media. A freshly uploaded file will not show up in this list right away — OnlyFans creates the vault entry when a post/message/story consumes the upload's processId, not at upload time. That is OnlyFans' own behaviour, not a limitation of this API: there is no upload-to-vault endpoint anywhere in the OnlyFans web client. (A POST /api2/v2/media upload route was documented in error until 2026-08-06 — it never existed and OnlyFans answers it with 404.)
Filtering (supported, but previously undocumented): list={list_id} restricts results to one folder, field=recent chooses the ordering field, and sort=asc|desc the direction — combine with limit/offset for paging. The response is wrapped in the standard passthrough envelope; the OnlyFans body ({ list, hasMore }) is under data.
Matching a local file to an existing item: the media object carries no filename or hash — use GET /api2/v2/vault/media/hash?h={md5}&size={bytes} instead.
OnlyFans only. Requests made with a user-id belonging to a Fansly account are rejected — use the platform-neutral CRM data routes (/notifications, /balances, /chats, /purchases, /subscribers/cached, ...) which are Fansly-aware.
Guide: The two surfaces
Authorization
apiKey Your CRM panel API key
In: header
Query Parameters
Restrict results to a single vault folder (a list ID from GET /vault/lists).
Ordering field. recent orders by upload time.
"recent"Value in
- "recent"
Sort direction.
"desc"Value in
- "asc"
- "desc"
240Header Parameters
Creator account ID of the account to act as (e.g. 509955039). Required — omitting it returns 400 user-id header is required. Use GET /accounts to list your connected accounts. On /api2/v2/* the account must be an OnlyFans account; Fansly accounts are rejected there.
Proxy URL — HTTP or SOCKS5 (e.g. http://user:pass@host:port or socks5://user:pass@host:port). Optional on post-connection routes, where it overrides the proxy saved at login time. Required on the connection routes (POST /accounts/login, POST /accounts/login/cookies, POST /accounts/login/verify-otp) for OnlyFans accounts; optional for Fansly.
Response Body
application/json
curl -X GET "https://example.com/api2/v2/vault/media" \ -H "user-id: 509955039"{ "success": true, "status_code": 0, "data": { "list": [ { "id": 0, "type": "photo", "createdAt": "2019-08-24T14:15:22Z", "duration": 0, "convertedToVideo": true, "canView": true, "isReady": true, "hasError": true, "hasPosts": true, "hasCustomPreview": true, "counters": { "buyersCount": 0, "likesCount": 0, "tipsSumm": 0 }, "listStates": [ { "id": 0, "name": "string", "hasMedia": true, "canAddMedia": true } ], "files": { "full": { "url": "string", "width": 0, "height": 0, "size": 0 }, "preview": { "url": "string", "width": 0, "height": 0 }, "thumb": { "url": "string", "width": 0, "height": 0 }, "squarePreview": { "url": "string", "width": 0, "height": 0 } }, "videoSources": { "property1": "string", "property2": "string" } } ], "hasMore": true }}