Ingest media from a remote URL
Import a guarded public media URL without turning your integration into an SSRF path.
Provide source_url when creating a media upload. App9 Post validates the URL, redirect chain, address range, response, file signature, MIME type, and media limits before processing the imported asset.
What this means in practice
Provide source_url when creating a media upload. App9 Post validates the URL, redirect chain, address range, response, file signature, MIME type, and media limits before processing the imported asset.
Use the documented brand and account boundaries consistently across the scheduler, REST API, SDK, MCP tools, SSE consumers, and webhooks. That makes the same social operation explainable to an operator and reproducible by an integration.
Implementation checklist
Use an HTTPS URL that returns the media bytes without an interactive login.
Keep the URL stable long enough for asynchronous ingestion.
Expect private, loopback, link-local, metadata-service, and unsafe redirect destinations to be rejected.
Observe media status rather than assuming URL acceptance means processing success.
Use the resulting App9 Post media ID for later posts.
Example request
This example uses a server-side API key and an explicit brand selection. Replace placeholder values and keep credentials out of browser bundles, client logs, and source control.
curl --request POST \
--url 'https://postapi.app9.co/v1/media/create-upload-url' \
--header 'Authorization: Bearer APP9_POST_API_KEY' \
--header 'X-App9-Post-Brand: BRAND_ID' \
--header 'Content-Type: application/json' \
--data '{
"file_name": "product-photo.jpg",
"kind": "image",
"content_type": "image/jpeg",
"size_bytes": 2400000,
"source_url": "https://cdn.example.com/campaign/product-photo.jpg"
}'Operational details
Remote ingestion is guarded because arbitrary server-side fetching creates security risk.
A URL may be public in a browser but still fail because of expiring signatures, redirects, or unsupported content.
The normalized media resource separates source location from delivery-ready variants.
Common mistakes to avoid
- Do not submit internal hostnames, IP literals, or cloud metadata URLs.
- Do not depend on a short-lived CDN URL that expires before processing.
- Do not skip attribution or licensing checks simply because the media is technically downloadable.