Media

Photos, plans, videos and private documents of listings and projects.

GET/v1/media

Media of a listing or project

In display order. Private documents are listed only for callers who may open them.

Access: API key with properties:read or projects:read, or a member session. Permission properties.view or projects.view.

Parameters

property_idquery: Id
Opaque record id.
project_idquery: Id
Opaque record id.

Response · 200

datarequired: array of Media
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/media' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "kind": "photo",
      "status": "processing",
      "failure": "string",
      "filename": "string",
      "mime_type": "string",
      "size_bytes": 0,
      "width": 0,
      "height": 0,
      "caption": "string",
      "room_tag": "string",
      "sort_order": 0,
      "is_cover": true,
      "is_private": true,
      "url": "string",
      "thumb_url": "string",
      "medium_url": "string",
      "large_url": "string",
      "watermarked_url": "string",
      "scan_status": "pending",
      "created_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/media

Register an uploaded file or an external link

Files are checked and processed in the background (status processing → ready or failed).

Access: API key with properties:write or projects:write, or a member session. Permission properties.edit or projects.edit.

Parameters

Idempotency-Keyheader: string
Unique key (a UUID) per logical request. A retry with the same key and body replays the first response for 24 hours (marked Idempotent-Replayed: true); the same key with another body is a 409.

Request body

property_id: Id
Opaque record id.
project_id: Id
Opaque record id.
kindrequired: MediaKind
key: string
The key from the presigned upload.
url: string (uri)
External link instead of a file (YouTube, Matterport): video and virtual_tour only.
content_type: string
filename: string
caption: string or null
room_tag: RoomTag or null
is_cover: boolean

Response · 201

datarequired: Media
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/media' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Idempotency-Key: 6c0f1d3e-…' \
  -H 'Content-Type: application/json' \
  -d '{"property_id":"cmusrceel0000q7kaafxqi1om","project_id":"cmusrceel0000q7kaafxqi1om","kind":"photo","key":"string","url":"https://example.com","content_type":"string","filename":"string","caption":"string","room_tag":"living","is_cover":true}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "kind": "photo",
    "status": "processing",
    "failure": "string",
    "filename": "string",
    "mime_type": "string",
    "size_bytes": 0,
    "width": 0,
    "height": 0,
    "caption": "string",
    "room_tag": "string",
    "sort_order": 0,
    "is_cover": true,
    "is_private": true,
    "url": "string",
    "thumb_url": "string",
    "medium_url": "string",
    "large_url": "string",
    "watermarked_url": "string",
    "scan_status": "pending",
    "created_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/media/reorder

Reorder media

Access: API key with properties:write or projects:write, or a member session. Permission properties.edit or projects.edit.

Request body

property_id: Id
Opaque record id.
project_id: Id
Opaque record id.
idsrequired: array of Id
Opaque record id.

Response · 200

datarequired: array of Media
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/media/reorder' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"property_id":"cmusrceel0000q7kaafxqi1om","project_id":"cmusrceel0000q7kaafxqi1om","ids":["cmusrceel0000q7kaafxqi1om"]}'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "kind": "photo",
      "status": "processing",
      "failure": "string",
      "filename": "string",
      "mime_type": "string",
      "size_bytes": 0,
      "width": 0,
      "height": 0,
      "caption": "string",
      "room_tag": "string",
      "sort_order": 0,
      "is_cover": true,
      "is_private": true,
      "url": "string",
      "thumb_url": "string",
      "medium_url": "string",
      "large_url": "string",
      "watermarked_url": "string",
      "scan_status": "pending",
      "created_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/media/uploads

Get an upload URL

A presigned PUT for one file (content type and exact size are signed). Limits per kind: photos 15 MB, plans 15 MB, brochures and documents 25 MB, videos 200 MB.

Access: API key with properties:write or projects:write, or a member session. Permission properties.edit or projects.edit.

Request body

property_id: Id
Opaque record id.
project_id: Id
Opaque record id.
kindrequired: "photo" | "floor_plan" | "master_plan" | "video" | "brochure" | "price_list" | …
filenamerequired: string
content_typerequired: string
sizerequired: integer

Response · 200

datarequired: PresignedUpload
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/media/uploads' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"property_id":"cmusrceel0000q7kaafxqi1om","project_id":"cmusrceel0000q7kaafxqi1om","kind":"photo","filename":"string","content_type":"string","size":1}'

Response example

{
  "data": {
    "key": "string",
    "url": "string",
    "method": "PUT",
    "headers": {},
    "expires_at": "2026-10-06T05:30:00.000Z",
    "max_bytes": 0
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/media/{id}

Caption, room tag or cover

Access: API key with properties:write or projects:write, or a member session. Permission properties.edit or projects.edit.

Parameters

idpathrequired: Id
Opaque record id.

Request body

caption: string or null
room_tag: RoomTag or null
is_cover: true
Makes this the cover (the previous cover is unset).

Response · 200

datarequired: Media
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/media/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"caption":"string","room_tag":"living","is_cover":true}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "kind": "photo",
    "status": "processing",
    "failure": "string",
    "filename": "string",
    "mime_type": "string",
    "size_bytes": 0,
    "width": 0,
    "height": 0,
    "caption": "string",
    "room_tag": "string",
    "sort_order": 0,
    "is_cover": true,
    "is_private": true,
    "url": "string",
    "thumb_url": "string",
    "medium_url": "string",
    "large_url": "string",
    "watermarked_url": "string",
    "scan_status": "pending",
    "created_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/media/{id}

Remove a file

Access: API key with properties:write or projects:write, or a member session. Permission properties.edit or projects.edit.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.deletedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/media/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "deleted": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/media/{id}/download

Signed download URL

A URL valid for 60 seconds to the original file. Private documents need permission to open the listing’s documents (edit access and the owner field visible).

Access: API key with properties:read or projects:read, or a member session. Permission properties.view or projects.view.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.urlrequired: string
data.expires_atrequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/media/{id}/download' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "url": "string",
    "expires_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

{ "data": [ { "id": "cmusrceel0000q7kaafxqi1om", "kind": "photo", "status": "processing", "failure": "string", "filename": "string", "mime_type": "string", "size_bytes": 0, "width": 0, "height": 0, "caption": "string", "room_tag": "string", "sort_order": 0, "is_cover": true, "is_private": true, "url": "string", "thumb_url": "string", "medium_url": "string", "large_url": "string", "watermarked_url": "string", "scan_status": "pending", "created_at": "2026-10-06T05:30:00.000Z" } ], "meta": {} }

curl -X POST 'https://api.propzolo.com/v1/media' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Idempotency-Key: 6c0f1d3e-…' \ -H 'Content-Type: application/json' \ -d '{"property_id":"cmusrceel0000q7kaafxqi1om","project_id":"cmusrceel0000q7kaafxqi1om","kind":"photo","key":"string","url":"https://example.com","content_type":"string","filename":"string","caption":"string","room_tag":"living","is_cover":true}'

{ "data": { "id": "cmusrceel0000q7kaafxqi1om", "kind": "photo", "status": "processing", "failure": "string", "filename": "string", "mime_type": "string", "size_bytes": 0, "width": 0, "height": 0, "caption": "string", "room_tag": "string", "sort_order": 0, "is_cover": true, "is_private": true, "url": "string", "thumb_url": "string", "medium_url": "string", "large_url": "string", "watermarked_url": "string", "scan_status": "pending", "created_at": "2026-10-06T05:30:00.000Z" }, "meta": {} }

curl -X POST 'https://api.propzolo.com/v1/media/reorder' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"property_id":"cmusrceel0000q7kaafxqi1om","project_id":"cmusrceel0000q7kaafxqi1om","ids":["cmusrceel0000q7kaafxqi1om"]}'

curl -X POST 'https://api.propzolo.com/v1/media/uploads' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"property_id":"cmusrceel0000q7kaafxqi1om","project_id":"cmusrceel0000q7kaafxqi1om","kind":"photo","filename":"string","content_type":"string","size":1}'

curl -X PATCH 'https://api.propzolo.com/v1/media/{id}' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"caption":"string","room_tag":"living","is_cover":true}'

GET/v1/media/{id}/download

Signed download URL

A URL valid for 60 seconds to the original file. Private documents need permission to open the listing’s documents (edit access and the owner field visible).

Access: API key with properties:read or projects:read, or a member session. Permission properties.view or projects.view.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.urlrequired: string
data.expires_atrequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/media/{id}/download' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "url": "string",
    "expires_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.