ok ok. The exact payload seems missing an opening and two closing brackets. I used this payload and was able to load by a super duper account.
$ cat media3.json
{"data": { "name": "Test menu 2", "record_pin": "1234", "retries": 3, "suppress_media": false, "timeout": 10000, "interdigit_timeout": 2000, "max_extension_length": 4, "allow_record_from_offnet": true, "hunt": true, "media": { "exit_media": true, "greeting": "someformofid", "invalid_media": true, "transfer_media": true }}}
--
$ curl -X PUT -d@media3.json -H "X-Auth-Token: $AUTH_TOKEN" http://localhost:8000/v2/media | python -mjson.tool
^ which gives me success status code.