Dynamic License constraints for CPIX-Based Workflows

This feature allows you to apply security rules on content resolution (SD, HD, UHD), using the IntendedTrackType attribute from the CPIX document. It is particularly useful for AWS MediaPackage V2 workflows, where Key IDs (KIDs) are generated dynamically and cannot be referenced statically.
 

Background / Problem Statement

Traditionally, hdcpOutputControl settings were associated directly with specific KIDs.
However, in dynamic packaging workflows—such as those used by AWS MediaPackage V2—KIDs are generated at runtime based on stream order and track configuration.

As a result:

• KIDs cannot be predicted or hardcoded.
• Enforcing different HDCP requirements per resolution (for example, HDCP 2.2 only for UHD content) becomes impractical when relying on static KID-based configuration.

 

Solution Overview

To address this limitation, the server now supports binding security rules to IntendedTrackType instead of individual KIDs.

By referencing the IntendedTrackType defined in the ContentKeyUsageRule section of the CPIX request, HDCP policies can be applied dynamically and reliably to the appropriate tracks, regardless of how KIDs are generated.
 

Supported Track Types

The following IntendedTrackType values are supported:

• SD
• HD
• UHD1
• UHD2
• AUDIO
• ALL

 

Configuration Details

Instead of specifying a KID in your Security configurations, define the target track using MediaTrackType.

The server will automatically:

• Identify all content keys associated with the specified track type
• Apply the configured security ruleoutput control to those keys at runtime

 

Example Use Case

 
Requirement:
Enforce HDCP version 2.2 exclusively for UHD content, while allowing lower HDCP versions for SD and HD.

Configuration Approach:
Set the hdcpOutputControl policy to target the UHD1 track type.

Result:
Any content key associated with the UHD1 track in the CPIX document will automatically receive the HDCP 2.2 enforcement, without requiring static KID references.
 

DRM Token Request Configuration

You can apply security rules per track type in DRM token requests using the mediaTrackType.N parameter.
 

Request Details

Method: POST

Drm Type	End point	Query Parameters	Description	Type	Required	Sample values
Widevine	https://wv-gen-license.service.expressplay.com/hms/wv/token	mediaTrackType.N	We can use this parameter to apply security rules. Only KEK and mediaTrackType.N /mediaTrackType combination will work.Instead of KID we can use this parameter	String	OPTIONAL	SD HD UHD1 UHD2 AUDIO VIDEO ALL
FairPlay	https://fp-gen-license.service.expressplay.com/hms/fp/token
PlayReady	https://pr-gen-license.service.expressplay.com/hms/pr/token

 

Retrieving Media Track Type from KMS

The media track type associated with a KID can also be retrieved using KMS APIs.

Get Key by KID

Endpoint
 

GET /keys/{kid}

 
Production URL
 

https://api.service.expressplay.com/keystore/keys/?customerAuthenticator=&kek=&mtt=

 
Query Parameter

Parameter	Description	Type	Required
mtt	If true, returns the track type for the KID	Boolean	Optional

 

Sample Response

{
“kid”: “7BAC3E9F5568401FB3B27D5A5325B483”,
“kekId”: “#1.81DAF6B5F09AE9FE657AF420B763BA1B7FB2EF2C”,
“ek”: “A0608DB68886337912EC3E867AE77A16A4F7D15E81E2577B”,
“k”: “7A8999B86773491396940A88729811CC”,
“lastUpdate”: “2025-11-27T04:56:43Z”,
“mediaTrackType”: “VIDEO”
}

 

Get All Keys

Endpoint
 

GET /keys

 
Production URL
 

https://api.service.expressplay.com/keystore/keys?customerAuthenticator=&kek=&mtt=

 
Query Parameter

Parameter	Description	Type	Required
mtt	If true, returns track type for all KIDs for the customer	Boolean	Optional

 

Sample Response

[
{
“kid”: “391ED0FCCDB246C1AD413D167F0E4232”,
“kekId”: “#1.81DAF6B5F09AE9FE657AF420B763BA1B7FB2EF2C”,
“ek”: “E4B40AB4E7BF089A2B24AE931E6C549BCE5B397CF58E9519”,
“k”: “2697B687551B45C7A97C1FD97080478E”,
“lastUpdate”: “2025-11-26T07:31:59Z”,
“mediaTrackType”: “ALL”
},
{
“kid”: “7B213CDB76B84CFCAAB715D37D801125”,
“kekId”: “#1.81DAF6B5F09AE9FE657AF420B763BA1B7FB2EF2C”,
“ek”: “EBE38E334F45BB19C6F270F0FE03843B785AEB99B3242CA5”,
“k”: “FFEAAB8427F9408AA55AA77E334C74E7”,
“iv”: “21BFE06B62256B42A3550F0620714111”,
“lastUpdate”: “2025-11-26T07:31:59Z”,
“mediaTrackType”: “VIDEO”
}
]