> ## Documentation Index > Fetch the complete documentation index at: https://apidocs.scripe.io/llms.txt > Use this file to discover all available pages before exploring further. # Add your own image to the media library > Register an image the customer supplied as a media-library asset of the project, so it can be attached to a post. This is the producer the library was missing on this surface. `POST /v1/uploads` accepts `image/*`, but its handle is consumed by `POST /v1/sources` and `POST /v1/knowledge` — neither of which produces media — and `PATCH /v1/posts/{postId}/media` takes either a library `img_…` id or a stored file key, never an upload handle. Every other library writer is first-party (the dashboard, the LinkedIn sync, `POST /v1/media/generations`). Two ways in, exactly one of them per call: - `content_base64` — the bytes inline, for SMALL files only (≤ ~3 MB decoded ≈ 4 MB as base64). Larger request bodies are rejected at the platform edge (~4.5 MB on the wire) with a bare HTTP 413 that carries no error envelope, so pre-check the file size instead of retrying inline. An optional `sha256` of the decoded bytes is verified after decode. - `uploadId` — an `upl_…` handle from `POST /v1/uploads`, after the bytes have been PUT to its signed URL. Preferred for anything larger than the inline cap; the signed PUT takes the full 25 MB image cap. The stored object is copied into the project's `image-library/` prefix with a file extension, which is what the publish step needs in order to tell an image from a document. The response is the same `MediaAsset` object `GET /v1/media` lists. The asset is returned `status: PROCESSING` and is attachable immediately — attach resolves the stored file, not the status. Cloudflare re-hosting and vision tagging run asynchronously; `GET /v1/media` (READY only) lists it once they finish. Sending the same bytes, or the same upload handle, twice returns the asset already created rather than a duplicate row. Re-sending the bytes of an asset that was deleted (MCP `delete_media_asset`) restores it under a freshly minted storage key, so an object an existing post already points at is never overwritten; the rare case where that restore cannot be recorded answers `409`. Images only: SVG is refused (it is a script-bearing document and LinkedIn rejects it), and a non-image content type is refused naming the endpoint that takes it. Requires `media:write`. ## OpenAPI ````yaml /openapi/v1.yaml post /media openapi: 3.1.0 info: title: Scripe Public API version: '2026-08-10' summary: >- Read and write Scripe workspace data — posts, notes, ideas, sources, knowledge, media, analytics, usage, async jobs, and webhooks. description: | The Scripe public API gives integrators stable, versioned access to a workspace's content surface: reads across every resource, synchronous writes (notes, posts, ideas, text sources, media assets), async jobs (post generation, file/URL/YouTube ingest, image and carousel generation), usage meters, and outbound webhooks. All endpoints (except `/v1/health`) require a Bearer token — either a workspace API key (`scripe_sk_*`) or an OAuth 2.1 access token (`scripe_oat_*`). Pin the API version with the `Scripe-Api-Version` request header to opt out of breaking changes. contact: name: Scripe Support url: https://scripe.io/support email: support@scripe.io license: name: Proprietary servers: - url: https://api.scripe.io/v1 description: Production security: - BearerApiKey: [] tags: - name: Health description: Liveness and authenticated key smoke tests. - name: Workspace description: The workspace + principal resolved from your API key. - name: Projects description: Personal-brand, company-page, and amplifier projects. - name: Notes description: Project notes with paired calendar slot. - name: Posts description: Drafts, scheduled, and published LinkedIn posts. - name: Analytics description: Your own LinkedIn analytics and viral-post inspiration search. - name: Sources description: Transcriptions (audio/video sources) with truncated body. - name: Uploads description: >- Pre-signed S3 PUT URLs the customer uploads bytes to before referencing via Sources or Knowledge. - name: Knowledge description: >- Knowledge-base documents indexed for RAG. Async ingest via text, file, URL, or YouTube. - name: Jobs description: >- Async-job lifecycle — submitted via post-generation, knowledge ingest, file source. - name: Calendar description: >- The content calendar — scheduled/planned posts, note slots, idea placements, and the posting-time template. - name: Ideas description: >- The idea board — creative briefs with derived workflow statuses and date-level calendar placement. - name: Media description: >- Media-library search, own-image imports, AI image generation, and full-state media writes onto posts. - name: Settings description: >- Curated project settings, engagement policy, and company pages (read-only over REST). - name: Webhooks description: | Outbound HTTP callbacks. Subscribe an endpoint to one or more event names; we POST a signed JSON payload every time a matching event fires in the workspace. The signing secret is shown once on create and once on rotate — verify the `Webhook-Signature: t=,v1=` header on every delivery. paths: /media: post: tags: - Media summary: Add your own image to the media library description: | Register an image the customer supplied as a media-library asset of the project, so it can be attached to a post. This is the producer the library was missing on this surface. `POST /v1/uploads` accepts `image/*`, but its handle is consumed by `POST /v1/sources` and `POST /v1/knowledge` — neither of which produces media — and `PATCH /v1/posts/{postId}/media` takes either a library `img_…` id or a stored file key, never an upload handle. Every other library writer is first-party (the dashboard, the LinkedIn sync, `POST /v1/media/generations`). Two ways in, exactly one of them per call: - `content_base64` — the bytes inline, for SMALL files only (≤ ~3 MB decoded ≈ 4 MB as base64). Larger request bodies are rejected at the platform edge (~4.5 MB on the wire) with a bare HTTP 413 that carries no error envelope, so pre-check the file size instead of retrying inline. An optional `sha256` of the decoded bytes is verified after decode. - `uploadId` — an `upl_…` handle from `POST /v1/uploads`, after the bytes have been PUT to its signed URL. Preferred for anything larger than the inline cap; the signed PUT takes the full 25 MB image cap. The stored object is copied into the project's `image-library/` prefix with a file extension, which is what the publish step needs in order to tell an image from a document. The response is the same `MediaAsset` object `GET /v1/media` lists. The asset is returned `status: PROCESSING` and is attachable immediately — attach resolves the stored file, not the status. Cloudflare re-hosting and vision tagging run asynchronously; `GET /v1/media` (READY only) lists it once they finish. Sending the same bytes, or the same upload handle, twice returns the asset already created rather than a duplicate row. Re-sending the bytes of an asset that was deleted (MCP `delete_media_asset`) restores it under a freshly minted storage key, so an object an existing post already points at is never overwritten; the rare case where that restore cannot be recorded answers `409`. Images only: SVG is refused (it is a script-bearing document and LinkedIn rejects it), and a non-image content type is refused naming the endpoint that takes it. Requires `media:write`. operationId: createMediaAsset parameters: - $ref: '#/components/parameters/ScripeApiVersion' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/MediaAssetCreate' responses: '200': description: The created (or already-existing) asset. content: application/json: schema: $ref: '#/components/schemas/MediaAssetResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': description: | A deleted asset could not be restored: its record of superseded storage keys is full (too many delete/restore cycles) or unreadable. Both keep the earlier copies reachable for erasure, so the restore is refused rather than dropping them. See [`conflict`](https://docs.scripe.io/api/v1/errors#conflict). content: application/json: schema: $ref: '#/components/schemas/Error' '422': $ref: '#/components/responses/Unprocessable' '429': $ref: '#/components/responses/RateLimited' components: parameters: ScripeApiVersion: name: Scripe-Api-Version in: header required: false description: | Pin the API version. Format `YYYY-MM-DD`. Omit to receive the currently rolling default. Unknown versions return `400 version_unsupported`. schema: type: string example: '2026-08-10' schemas: MediaAssetCreate: type: object description: | Exactly one of `content_base64` or `uploadId` is required. properties: projectId: type: string description: | Project whose library receives the image. Optional for an OAuth principal with a default project pinned at consent time. example: proj_a1b2c3d4e5f6g7h8 content_base64: type: string description: | Base64-encoded image bytes, ≤ ~3 MB decoded (larger request bodies are rejected at the platform edge as a bare HTTP 413 — use the `uploadId` path instead). Mutually exclusive with `uploadId`. sha256: type: string description: | Optional hex SHA-256 of the DECODED image bytes (inline path only; refused beside `uploadId`). Strongly recommended when the caller can compute it — base64 relayed through model output corrupts silently, and a digest mismatch is rejected naming both digests instead of storing the wrong bytes. uploadId: type: string description: | `upl_…` handle from `POST /v1/uploads`, after the bytes have been PUT to its signed URL. Mutually exclusive with `content_base64`. A handle whose object does not exist is a 422, not a 404 — the handle is valid, the upload never happened. example: upl_org_2aSH--30e8e643de8b4f01 fileName: type: string maxLength: 200 description: | Original filename. On the inline path it is also how the content type is inferred when `mimeType` is omitted. example: keynote-stage.jpg mimeType: type: string maxLength: 200 description: | Image MIME type for the inline path. Ignored on the `uploadId` path, where the stored object's own content type (bound into the signature at mint time) is authoritative. example: image/png alt: type: string maxLength: 1000 description: Alt text, carried onto the post at attach time. title: type: string maxLength: 120 MediaAssetResponse: type: object required: - data properties: data: $ref: '#/components/schemas/MediaAsset' Error: type: object required: - error properties: error: type: object required: - code - message - request_id - docs_url properties: code: type: string description: Stable, machine-readable error identifier. example: not_found message: type: string request_id: type: string example: req_a1b2c3d4e5f6 docs_url: type: string format: uri details: description: Optional structured payload — shape varies per code. MediaAsset: type: object required: - id - projectId - source - status - tags - reusability - createdAt properties: id: type: string example: img_a1b2c3d4e5f6g7h8 projectId: type: string source: type: string enum: - UPLOAD - LINKEDIN_SYNC - GENERATED status: type: string title: type: string nullable: true fileName: type: string nullable: true mimeType: type: string nullable: true width: type: integer nullable: true height: type: integer nullable: true alt: type: string nullable: true tags: type: array items: type: string aiCaption: type: string nullable: true reusability: type: string generatedAssetKind: type: string nullable: true provenance: type: object nullable: true properties: provider: type: string nullable: true authorName: type: string nullable: true permalink: type: string nullable: true displayUrl: type: string nullable: true description: >- Durable Cloudflare delivery URL, or a short-lived backup URL, or null. createdAt: type: string responses: BadRequest: description: Malformed request (bad cursor, bad limit, etc.). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing, malformed, expired, or revoked API key. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Plan not eligible, scope missing, or workspace mismatch. content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found in this workspace. content: application/json: schema: $ref: '#/components/schemas/Error' Unprocessable: description: Body shape was JSON but failed validation (`unprocessable`). content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: Sliding-window rate limit exceeded. headers: Retry-After: schema: type: integer X-RateLimit-Limit: schema: type: integer X-RateLimit-Remaining: schema: type: integer X-RateLimit-Reset: schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: BearerApiKey: type: http scheme: bearer bearerFormat: scripe_sk_live_* description: | Pass `Authorization: Bearer scripe_sk_live_<...>` (or `scripe_sk_test_<...>` for test keys) on every request. Keys are scoped to a single workspace and can be revoked from the Scripe dashboard. The same header also accepts an OAuth 2.1 access token (`scripe_oat_*`); both credentials share one scope vocabulary and every operation below documents the scope it requires. An API key can hold every scope named on this surface except `webhooks:manage`, which is grantable to OAuth tokens only today — the webhook-endpoint operations answer `403 scope_missing` to every API key. Operations that name no scope accept any valid token of the workspace. ````