Do AI-generated video URLs expire? How Sume stores outputs

Not for Sume Format runs and Agent Completions: both return the media they generate as durable media.sume.com HTTPS URLs that do not expire, so you can store a URL and render it later. The same URL is public: anyone who holds it can fetch the file.

This answer draws on Sume's Runs and results, Structured output, and Embed a Format docs, read on 2026-09-27. Three other surfaces are described differently, covered below: generation job results, the Image API, and the /v1/videos download route.

Which Sume output URLs never expire?

Sume mirrors generated outputs into Sume-owned media URLs before it exposes them. The Structured output docs, which cover Format run output, add that Sume-hosted media is served from media.sume.com as public, max-age=31536000, immutable and does not expire, so a stored run URL needs no refresh step before you render it. The jobs pages call job artifacts public but state no expiry rule for them.

Who can open a media.sume.com URL?

Anyone who has the link. The cookbook warns that a durable URL ends up in your logs, your error reports, and your customer's browser history, so if customer A must never see customer B's output, proxy the bytes through your own authenticated route or serve your own copy.

Keep the links out of support tickets as well: the Format error docs ask you not to send API keys, signing secrets, or raw media URLs. A public URL is still not an input for another workspace: video trim takes only your own workspace's media.sume.com artifact or asset, and answers source_not_found for a foreign one.

Should I store the URL or copy the file?

Either works, but decide. Linking is free and instant. Copying costs you storage but survives you ever leaving Sume; to have that guarantee, copy on the webhook, before you mark the record ready. How to embed AI video generation in your product shows where this fits in a multi-tenant app.

• Store the Sume URL, never a raw provider URL. Raw provider URLs are not part of the public result contract.
• artifacts[] is empty until the run is terminal, then lists every durable file the run generated, on failures too, so check it before you give up on a failed run.

Which URLs are signed, or need an API key?

The Image API is the exception to plan for. POST /v1/images returns data[].url as a Sume-hosted, signed URL, and its docs do not call it durable. The authentication docs say to treat signed upload and download URLs as temporary secrets, so copy an image you need to keep.

On /v1/videos, the poll response's unsigned_urls[] point at GET /v1/videos/{id}/content on api.sume.com. That route needs your API key and redirects to the generated video; while the job is still running it answers 409 job_not_completed. Download a generated video from the API covers that route, and the Sume API reference has its schema.

In structured output, every media file carries expires_at. It is null for durable media.sume.com URLs, the normal case, and populated only when a signed URL is returned, so your code can branch on it.