> ## Documentation Index > Fetch the complete documentation index at: https://apidocs.scripe.io/llms.txt > Use this file to discover all available pages before exploring further. # Set a post's media (full-state) > Replaces the post's media in one write — read `media` on the post first and resend the entries you are keeping, or they are gone. Library images resolve to durable S3 keys server-side, so a post never depends on an expiring CDN URL; assets without a stored original are rejected with `unprocessable`. `source: "key"` takes a stored file key — one the post already carries. A media-library id (`img_…`), an upload handle (`upl_…`) or a `displayUrl` is rejected with `unprocessable` naming the branch that accepts it, because the publish step classifies the key by extension and cannot use any of them: an unclassifiable key used to be stored happily and then fail on the publish cron, hours later. A post the dashboard gave a LinkedIn poll refuses media with `conflict` and is left unchanged: a post publishes media or a poll, never both. Clearing media (`kind: "none"`) is not refused. The response echoes the post's resulting media. Requires `posts:write` AND `media:read`. ## OpenAPI ````yaml /openapi/v1.yaml patch /posts/{postId}/media openapi: 3.1.0 info: title: Scripe Public API version: '2026-08-10' summary: >- Read and write Scripe workspace data — posts, notes, ideas, sources, knowledge, media, analytics, usage, async jobs, and webhooks. description: | The Scripe public API gives integrators stable, versioned access to a workspace's content surface: reads across every resource, synchronous writes (notes, posts, ideas, text sources, media assets), async jobs (post generation, file/URL/YouTube ingest, image and carousel generation), usage meters, and outbound webhooks. All endpoints (except `/v1/health`) require a Bearer token — either a workspace API key (`scripe_sk_*`) or an OAuth 2.1 access token (`scripe_oat_*`). Pin the API version with the `Scripe-Api-Version` request header to opt out of breaking changes. contact: name: Scripe Support url: https://scripe.io/support email: support@scripe.io license: name: Proprietary servers: - url: https://api.scripe.io/v1 description: Production security: - BearerApiKey: [] tags: - name: Health description: Liveness and authenticated key smoke tests. - name: Workspace description: The workspace + principal resolved from your API key. - name: Projects description: Personal-brand, company-page, and amplifier projects. - name: Notes description: Project notes with paired calendar slot. - name: Posts description: Drafts, scheduled, and published LinkedIn posts. - name: Analytics description: Your own LinkedIn analytics and viral-post inspiration search. - name: Sources description: Transcriptions (audio/video sources) with truncated body. - name: Uploads description: >- Pre-signed S3 PUT URLs the customer uploads bytes to before referencing via Sources or Knowledge. - name: Knowledge description: >- Knowledge-base documents indexed for RAG. Async ingest via text, file, URL, or YouTube. - name: Jobs description: >- Async-job lifecycle — submitted via post-generation, knowledge ingest, file source. - name: Calendar description: >- The content calendar — scheduled/planned posts, note slots, idea placements, and the posting-time template. - name: Ideas description: >- The idea board — creative briefs with derived workflow statuses and date-level calendar placement. - name: Media description: >- Media-library search, own-image imports, AI image generation, and full-state media writes onto posts. - name: Settings description: >- Curated project settings, engagement policy, and company pages (read-only over REST). - name: Webhooks description: | Outbound HTTP callbacks. Subscribe an endpoint to one or more event names; we POST a signed JSON payload every time a matching event fires in the workspace. The signing secret is shown once on create and once on rotate — verify the `Webhook-Signature: t=,v1=` header on every delivery. paths: /posts/{postId}/media: patch: tags: - Media - Posts summary: Set a post's media (full-state) description: | Replaces the post's media in one write — read `media` on the post first and resend the entries you are keeping, or they are gone. Library images resolve to durable S3 keys server-side, so a post never depends on an expiring CDN URL; assets without a stored original are rejected with `unprocessable`. `source: "key"` takes a stored file key — one the post already carries. A media-library id (`img_…`), an upload handle (`upl_…`) or a `displayUrl` is rejected with `unprocessable` naming the branch that accepts it, because the publish step classifies the key by extension and cannot use any of them: an unclassifiable key used to be stored happily and then fail on the publish cron, hours later. A post the dashboard gave a LinkedIn poll refuses media with `conflict` and is left unchanged: a post publishes media or a poll, never both. Clearing media (`kind: "none"`) is not refused. The response echoes the post's resulting media. Requires `posts:write` AND `media:read`. operationId: attachMediaToPost parameters: - $ref: '#/components/parameters/ScripeApiVersion' - name: postId in: path required: true schema: type: string example: post_a1b2c3d4e5f6g7h8 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AttachMediaRequest' responses: '200': description: Media set. content: application/json: schema: $ref: '#/components/schemas/AttachMediaResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': description: | The post carries a LinkedIn poll, and a post publishes either media or a poll, never both. Nothing is written; remove the poll in the Scripe dashboard first. See [`conflict`](https://docs.scripe.io/api/v1/errors#conflict). content: application/json: schema: $ref: '#/components/schemas/Error' '422': $ref: '#/components/responses/Unprocessable' '429': $ref: '#/components/responses/RateLimited' components: parameters: ScripeApiVersion: name: Scripe-Api-Version in: header required: false description: | Pin the API version. Format `YYYY-MM-DD`. Omit to receive the currently rolling default. Unknown versions return `400 version_unsupported`. schema: type: string example: '2026-08-10' schemas: AttachMediaRequest: type: object required: - media properties: media: description: >- Discriminated on `kind` — images (from library `img_…` ids or upload keys), video, document (PDF), or none to clear. oneOf: - type: object required: - kind - images properties: kind: type: string enum: - images images: type: array minItems: 1 maxItems: 20 items: oneOf: - type: object required: - source - key properties: source: type: string enum: - key key: type: string alt: type: string name: type: string - type: object required: - source - assetId properties: source: type: string enum: - library assetId: type: string example: img_a1b2c3d4e5f6g7h8 alt: type: string maxLength: 1000 description: >- Alt-text override for this post; omit to use the library asset's own alt text. - type: object required: - kind - video properties: kind: type: string enum: - video video: type: object required: - key properties: key: type: string alt: type: string name: type: string thumbnailKey: type: string title: type: string maxLength: 200 description: >- Display title LinkedIn renders as a label bar under the video player. Omit (the default) to publish with no title, like a natively composed video post. - type: object required: - kind - document properties: kind: type: string enum: - document document: type: object required: - key properties: key: type: string alt: type: string name: type: string title: type: string maxLength: 200 description: >- Display title LinkedIn renders over the document. Wins over `name`; omit to derive from the file name. - type: object required: - kind properties: kind: type: string enum: - none AttachMediaResponse: type: object required: - data properties: data: type: object required: - postId - kind - media properties: postId: type: string kind: type: string enum: - images - video - document - none media: allOf: - $ref: '#/components/schemas/PostMedia' description: >- The post's RESULTING media, read back the same way `GET /v1/posts/{postId}` reports it. The write is not the identity: a library id resolves to a stored key, and a `.pdf` sent as an image comes back as a document, which is how it will publish. Error: type: object required: - error properties: error: type: object required: - code - message - request_id - docs_url properties: code: type: string description: Stable, machine-readable error identifier. example: not_found message: type: string request_id: type: string example: req_a1b2c3d4e5f6 docs_url: type: string format: uri details: description: Optional structured payload — shape varies per code. PostMedia: description: >- A post's attached media. `kind: none` (with no sibling field) is a post with no media. Keys are stored-file keys, never display URLs — the same values the media write accepts as `source: "key"`. oneOf: - type: object required: - kind - images properties: kind: type: string enum: - images images: type: array items: $ref: '#/components/schemas/PostAttachment' - type: object required: - kind - video properties: kind: type: string enum: - video video: allOf: - $ref: '#/components/schemas/PostAttachment' - type: object properties: thumbnailKey: type: string title: type: string maxLength: 200 description: >- Display title LinkedIn renders as a label bar under the video player; absent means the post publishes with no title. - type: object required: - kind - document properties: kind: type: string enum: - document document: allOf: - $ref: '#/components/schemas/PostAttachment' - type: object properties: title: type: string maxLength: 200 description: >- Display title LinkedIn renders over the document. Wins over `name`; absent means the title is derived from the file name. - type: object required: - kind properties: kind: type: string enum: - none PostAttachment: type: object required: - key properties: key: type: string description: Stored file key, e.g. `rrb7bw8pfuc.png`. example: rrb7bw8pfuc.png alt: type: string name: type: string description: Original filename; LinkedIn shows it as a PDF's title. responses: BadRequest: description: Malformed request (bad cursor, bad limit, etc.). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing, malformed, expired, or revoked API key. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Plan not eligible, scope missing, or workspace mismatch. content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found in this workspace. content: application/json: schema: $ref: '#/components/schemas/Error' Unprocessable: description: Body shape was JSON but failed validation (`unprocessable`). content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: Sliding-window rate limit exceeded. headers: Retry-After: schema: type: integer X-RateLimit-Limit: schema: type: integer X-RateLimit-Remaining: schema: type: integer X-RateLimit-Reset: schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: BearerApiKey: type: http scheme: bearer bearerFormat: scripe_sk_live_* description: | Pass `Authorization: Bearer scripe_sk_live_<...>` (or `scripe_sk_test_<...>` for test keys) on every request. Keys are scoped to a single workspace and can be revoked from the Scripe dashboard. The same header also accepts an OAuth 2.1 access token (`scripe_oat_*`); both credentials share one scope vocabulary and every operation below documents the scope it requires. An API key can hold every scope named on this surface except `webhooks:manage`, which is grantable to OAuth tokens only today — the webhook-endpoint operations answer `403 scope_missing` to every API key. Operations that name no scope accept any valid token of the workspace. ````