---
title: "Get a WhatsApp message's media"
method: GET
path: "/v1/whatsapp/messages/{message_id}/media/{media_id}"
tags: ["whatsapp-messages"]
---

# Get a WhatsApp message's media

`GET /v1/whatsapp/messages/{message_id}/media/{media_id}`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/whatsapp/messages/{message_id}/media/{media_id}`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Redirects to a short-lived URL for the media on a received WhatsApp message,
or on one from the WhatsApp Business app on a number shared with it: sent
from the app (`origin: business_app_echo`) or imported from its chat
history (`origin: history_sync`). That media is stored because WhatsApp's own
URL is not fetchable without our credentials; this endpoint is what the `url` on the message's
`image`, `video`, `audio`, `sticker` or `document` points at. The bytes
live in object storage and are served straight from there, so they never
transit the API.

The response is a `302` whose `Location` is that pre-authorized storage URL,
valid for 15 minutes; your client must follow redirects. The `Authorization`
header must be absent from the request that fetches that URL: a client that
attaches credentials centrally, at its transport, interceptor or middleware
layer rather than per request, re-adds the header on every hop including the
redirect, so the storage URL must be fetched with a client that carries
none.

Media is kept for 30 days after the message is received, and the message
itself is kept longer. A message older than that still lists its media's
`mime_type` and `caption`, and this operation returns `410` once the bytes
have expired. Other outbound messages have no media to serve.

## Headers

- `X-Workspace-Id` string
- `X-Organization-Id` string

## Other responses

- `302`: Redirect to a storage URL valid for 15 minutes.
- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `410`: The resource existed but is no longer available.
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/3e2a50466454?raw)