primaryMediaId for the verified media and posterMediaId for the poster frame. The URL is valid for five minutes; download promptly and stream directly from it. Any API key for the workspace can ask for one.
For long-term availability, extend the media hold instead of copying the bytes.