Replace a vault item’s content tags
Replaces (not merges) the content tags on a vault item. Send the full list every time.
/api/external/v1/vault/{id}/tagsalso served at /api/external/vault/{id}/tagsReplaces (not merges) the content tags on a vault item. Send the full list every time.
Tags are trimmed, de-duplicated, silently truncated to 64 characters each, and capped at 50 tags — the response echoes what was actually stored, so compare it to what you sent.
The body field is contentTags, not tags.
Authentication
Send the creator's API key as a bearer token: Authorization: Bearer dpfn_…. See Authentication & API keys.
For a creator you manage or onboarded
PATCH /api/external/v1/creators/{creatorId}/vault/{id}/tags — an agency's own key for a creator or AI persona it manages (needs canManageVault), or your app owner's own key for an account your app onboarded. The X-Dropfans-Account header still works but is deprecated. See Acting for a creator.
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
id | string | Required | The vault item id. |
Request body
Content type: application/json
| Name | Type | Required | Description |
|---|---|---|---|
contentTags | string[] | Required | The complete new tag list (≤50 kept). Max items: 50 |
{
"contentTags": [
"beach",
"bikini"
]
}Responses
| Name | Type | Description |
|---|---|---|
success | boolean | Always true. |
contentTags | string[] | The tags after trimming, de-duplication and capping. |
{
"success": true,
"contentTags": [
"beach",
"bikini"
]
}Errors
| Status | Body | When |
|---|---|---|
| 400 | {"error":"Invalid JSON body"} | The body is not valid JSON. |
| 400 | {"error":"contentTags must be an array of strings"} | Missing, not an array, or contains non-strings. |
| 401 | {"error":"Unauthorized","code":"unauthorized"} | Missing or invalid API key. |
| 404 | {"error":"Vault item not found"} | No such item on this account. |
| 400 | {"error":"X-Dropfans-Account must be an account id (from GET /api/external/agency/creators), not a username.","code":"invalid_account_header"} | `X-Dropfans-Account` is not an account id. |
| 400 | {"error":"X-Dropfans-Account names a different account than the path — send one or the other.","code":"account_mismatch"} | Called under /v1/creators/{creatorId}/ with an `X-Dropfans-Account` naming another account. |
| 403 | {"error":"This key cannot act for that account.","code":"account_not_managed"} | The creator in the path (or `X-Dropfans-Account`) is one this key cannot act for: no ACCEPTED management by your agency and not an account your app onboarded (or it no longer holds a key bound to your app), a key minted for one creator, or someone is suspended, banned or deleted. An unknown id gets the same answer. |
| 403 | {"error":"The agency does not have permission for this on that account.","code":"permission_denied","permission":"canManageVault"} | For a managed creator: the agency lacks `canManageVault` on that account. |
| 403 | {"error":"This app does not have the vault API category enabled. Contact support to enable it.","code":"api_category_disabled","category":"vault"} | Your app has the Vault [API category](/developers/concepts/api-categories) switched off. |
Rate limiting
Every response carries the X-RateLimit-Tier header and, on limited tiers, the per-minute and per-day trios — read X-RateLimit-Remaining and X-RateLimit-Reset instead of hardcoding limits. Details in Rate limits.
Code samples
curl -X PATCH "https://www.dropfans.io/api/external/v1/vault/$VAULT_ITEM_ID/tags" \
-H "Authorization: Bearer $DROPFANS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"contentTags": [
"beach",
"bikini"
]
}'const vaultItemId = '…'; // from an earlier response
const res = await fetch(`https://www.dropfans.io/api/external/v1/vault/${vaultItemId}/tags`, {
method: 'PATCH',
headers: {
Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
"contentTags": [
"beach",
"bikini"
]
}),
});
console.log(await res.json());import os
import requests
vault_item_id = "…" # from an earlier response
res = requests.patch(
f"https://www.dropfans.io/api/external/v1/vault/{vault_item_id}/tags",
headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
json={
"contentTags": [
"beach",
"bikini",
],
},
)
print(res.json())Questions? support@dropfans.io