CPIX API Guide

Overview

The CPIX API is an API implemented in accordance with the Content Protection Information Exchange Format (CPIX) Standard Guide as defined by the DASH Industry Forum. It defines specifications that link the keys required to apply multi-DRM in the process of packaging media contents. With this API, PallyCon Multi DRM can be easily linked with encoder/transcoder solution supporting CPIX based key exchange.

CPIX API Types

PallyCon Multi DRM can be integrated with the following types of CPIX API depending on the implementation subject of API.

  • PallyCon CPIX API: The CPIX API implemented by PallyCon, allowing encoder/transcoder solution vendors to work with PallyCon Multi DRM with the corresponding API. Flussonic Media Server is integrated using PallyCon CPIX API.

  • SPEKE API: The CPIX API implemented by AWS Elemental, which is pre-integrated with PallyCon to easily apply PallyCon Multi DRM to MediaPackage or MediaConvert products of AWS Elemental Media Service. For more information about SPEKE API integration, please refer to the guide.

  • ATEME NEA-DVR CPIX API: The CPIX API implemented by Anevia(now ATEME). It can be applied to NEA-DVR solution for PallyCon Multi DRM integration.

Also, for PallyCon CPIX API, you can choose one of the following two methods depending on how you implement the integration.

  • PallyCon CPIX API client
  • Direct call of KMS URL

PallyCon CPIX API client

PallyCon CPIX API client provides pre-implemented CPIX client modules for each major development language. These modules implement the functions of generating request data and interpreting response data in XML format for communication with the KMS server.

Specifications

The PallyCon CPIX API client supports the following specifications.

Item Specification Description
Programming language C++, C#, Java, Python Provides language-specific samples for DRM packaging integration development environments
DRM type Widevine, PlayReady, FairPlay, NCG, HLS_NCG - NCG: Used to encrypt the entire target file with NCG which is PallyCon’s proprietary DRM.
- HLS_NCG: NCG-compliant key encryption of AES-128 encrypted HLS content
Encryption method CENC, CBC1, CENS, CBCS Typically specifies CENC or CBCS, depending on the AES encryption scheme supported by the client platform.
Track type ALL_TRACKS, AUDIO, SD, HD, UHD1, UHD2 Used for multi-key packaging to apply different encryption keys per track
Only two encryption schemes are used for multi-DRM content: CENC (AES-CTR) and CBCS (AES-CBC with subsample). CENC is used for packaging DASH content that supports PlayReady and Widevine DRM, and CBCS encryption must be applied when packaging HLS or CMAF that requires FairPlay support.

API client download

You can download the PallyCon CPIX API client from the following Github repository.

PallyCon CPIX API client Github repository

Example of using the API client (in Python)

1. Set the KMS token value

Enter the PallyCon KMS URL and KMS Token values in the CpixClient object as follows: (See app_sample.py source for sample code)

cpix_client = CpixClient(PALLYCON_KMS_URL, YOUR_KMS_TOKEN)

2. Send CPIX API request

The Python version of the CPIX API client can send a CPIX request to the PallyCon KMS server through the following code.

pack_info = cpix_client.get_content_key_info_from_pallycon_kms("test_content_id", DrmType.WIDEVINE | DrmType.PLAYREADY | DrmType.FAIRPLAY)

The above code requests information from the PallyCon KMS server to package the content with the ID of test_content_id into three different DRMs: Widevine, PlayReady, and FairPlay. The omitted parameter, encryption_scheme, has a default value of CENC, which is reflected in the PSSH data of Widevine and PlayReady. (The response data of FairPlay DRM is not affected by the encryption_scheme input value.)

When packaging HLS or CMAF content with FairPlay DRM, it must be encrypted with CBCS, regardless of the encryption_scheme entered in the CPIX API request.

To specify the encryption method more explicitly, you can also split the API into two calls, as shown below.

# CENC encryption for DASH content with PlayReady and Widevine DRM
dash_pack_info = cpix_client.get_content_key_info_from_pallycon_kms("test_content_id", DrmType.WIDEVINE | DrmType.PLAYREADY, EncryptionScheme.CENC)

# CBCS encryption for HLS content with FairPlay DRM
hls_pack_info = cpix_client.get_content_key_info_from_pallycon_kms("test_content_id", DrmType.FAIRPLAY,  EncryptionScheme.CBCS)

3. Check CPIX API response

A successful API request will generate response data in JSON format like this.

{
  "content_id": "test_content_id",
  "content_key_list": [
    {
      "key_id_hex": "cbbc38b6b50dab53f8263e06b7382aa3",
      "key_id_b64": "y7w4trUNq1P4Jj4Gtzgqow==",
      "key_hex": "959dbd673980e1d1bdf2d36209495f4e",
      "key_b64": "lZ29ZzmA4dG98tNiCUlfTg==",
      "iv_hex": "30313233343536373839616263646566",
      "iv_b64": "MDEyMzQ1Njc4OWFiY2RlZg==",
      "widevine": {
        "pssh": "AAAATHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAACwIARIQy7w4trUNq1P4Jj4GtzgqoxoMaW5rYWVudHdvcmtzIghkZW1vdGVzdA==",
        "pssh_payload_only": "CAESEMu8OLa1DatT+CY+Brc4KqMaDGlua2FlbnR3b3JrcyIIZGVtb3Rlc3Q="
      },
      "playready": {
        "pssh": "AAACknBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAAnJyAgAAAQABAGgCPABXAFIATQBIAEUAQQBEAEUAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZAB5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMwAuADAALgAwACIAPgA8AEQAQQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBJAEQAUwA+ADwASwBJAEQAIABBAEwARwBJAEQAPQAiAEEARQBTAEMAVABSACIAIABDAEgARQBDAEsAUwBVAE0APQAiAEgARQBzAHYAbABYAFUAeABuAFcAdwA9ACIAIABWAEEATABVAEUAPQAiAHQAagBpADgAeQB3ADIAMQBVADYAdgA0AEoAagA0AEcAdAB6AGcAcQBvAHcAPQA9ACIAPgA8AC8ASwBJAEQAPgA8AC8ASwBJAEQAUwA+ADwALwBQAFIATwBUAEUAQwBUAEkATgBGAE8APgA8AEwAQQBfAFUAUgBMAD4AaAB0AHQAcABzADoALwAvAGwAaQBjAGUAbgBzAGUALgBwAGEAbABsAHkAYwBvAG4ALgBjAG8AbQAvAHIAaQAvAGwAaQBjAGUAbgBzAGUATQBhAG4AYQBnAGUAcgAuAGQAbwA8AC8ATABBAF8AVQBSAEwAPgA8AC8ARABBAFQAQQA+ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA==",
        "pssh_payload_only": "cgIAAAEAAQBoAjwAVwBSAE0ASABFAEEARABFAFIAIAB4AG0AbABuAHMAPQAiAGgAdAB0AHAAOgAvAC8AcwBjAGgAZQBtAGEAcwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBEAFIATQAvADIAMAAwADcALwAwADMALwBQAGwAYQB5AFIAZQBhAGQAeQBIAGUAYQBkAGUAcgAiACAAdgBlAHIAcwBpAG8AbgA9ACIANAAuADMALgAwAC4AMAAiAD4APABEAEEAVABBAD4APABQAFIATwBUAEUAQwBUAEkATgBGAE8APgA8AEsASQBEAFMAPgA8AEsASQBEACAAQQBMAEcASQBEAD0AIgBBAEUAUwBDAFQAUgAiACAAQwBIAEUAQwBLAFMAVQBNAD0AIgBIAEUAcwB2AGwAWABVAHgAbgBXAHcAPQAiACAAVgBBAEwAVQBFAD0AIgB0AGoAaQA4AHkAdwAyADEAVQA2AHYANABKAGoANABHAHQAegBnAHEAbwB3AD0APQAiAD4APAAvAEsASQBEAD4APAAvAEsASQBEAFMAPgA8AC8AUABSAE8AVABFAEMAVABJAE4ARgBPAD4APABMAEEAXwBVAFIATAA+AGgAdAB0AHAAcwA6AC8ALwBsAGkAYwBlAG4AcwBlAC4AcABhAGwAbAB5AGMAbwBuAC4AYwBvAG0ALwByAGkALwBsAGkAYwBlAG4AcwBlAE0AYQBuAGEAZwBlAHIALgBkAG8APAAvAEwAQQBfAFUAUgBMAD4APAAvAEQAQQBUAEEAPgA8AC8AVwBSAE0ASABFAEEARABFAFIAPgA="
      },
      "fairplay": {
        "key_uri": "skd://y7w4trUNq1P4Jj4Gtzgqow=="
      }
    }
  ]
}

When integrating with various third-party encoder/transcoder/packager solutions, you may obtain the following DRM encryption information from the CPIX API response and enter them into the solution. The values and formats used for integration may differ for each solution, so please refer to the solution’s guide.

  • key_id_hex, key_id_b64, key_hex, key_b64, iv_hex, iv_b64: Represents the Key ID, Key, and IV values in hexadecimal or Base64 form, respectively.
  • pssh: The PSSH data used by PlayReady or Widevine including header
  • pssh_payload_only: The portion of the payload with headers removed from the pssh data.
  • key_uri: The value of the URI parameter contained in the #EXT-X-Key tag of a FairPlay DRM-enabled HLS m3u8 file.

For instructions on using other language versions of the CPIX client, please refer to the README documentation included in the folder for each development language in the GitHub repository.

Direct call of KMS URL

When integrating the CPIX API by calling the KMS URL directly instead of the PallyCon CPIX API client, check the following points to handle request data generation and response data interpretation and application.

Supported Features

Integration via direct KMS URL calls supports the following content and features

PlayReady Widevine FairPlay AES-128
DASH (key rotation supported) (key rotation supported)
HLS (key rotation supported) (NCG DRM supported)

KMS URL Specification

PallyCon CPIX API provides the following KMS URL specifications. The enc-token at the end of the URL is an API authentication token that is generated when you sign up PallyCon service, and can be found on the PallyCon Console site.

KMS URL V1 - https://kms.pallycon.com/v1/cpix/pallycon/getKey/{enc-token}
KMS URL V2 - https://kms.pallycon.com/v2/cpix/pallycon/getKey/{enc-token}

Encoder/transcoder solution calls the above URL to get the key needed for DRM encryption. Add the CPIX data as shown in the following example to the body part of the request data, and call it by POST method.

KMS Specification V2 and Multi-key Packaging

Request/response data for multi-key packaging has been added to the V2 specification. Multi-key packaging encrypts video tracks by resolution with different keys, and is required for setting the security level for each resolution by Hollywood Studio requirement.

For multi-key packaging, the following items should be added to the corresponding XML request data.

If you want to package with single key, you may remove the below items from the example request XML.

IntendedTrackType

Sets the track type (SD, HD, etc) to be encrypted with the kid in cpix:ContentKeyUsageRule tag. The values that can be entered and the default resolution are as follows.

  • AUDIO: for audio track
  • SD: 576p or less
  • HD: 720p ~ 1080p
  • UHD1: 4K
  • UHD2: 8K
VideoFilter

You can set the min/max pixels of the video track using VideoFilter tag and minPixels / maxPixels parameters.

Content ID Specification

When packaging content with PallyCon CPIX API, you must enter a unique content ID(CID) managed by the CMS of the content service. The CID is registered with PallyCon license server and used to request and issue DRM licenses on content playback.

Enter the content ID (max 200 alphanumeric characters) in the cpix:CPIX tag of the request body(XML) for each content type as below.

<cpix:CPIX id="your-content-id"

Examples of request and response data

Example for DASH VOD content

Request body
<?xml version="1.0" encoding="UTF-8"?>
<cpix:CPIX id="your-content-id" xmlns:cpix="urn:dashif:org:cpix" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" xmlns:speke="urn:aws:amazon:com:speke">
  <cpix:ContentKeyList>
      <cpix:ContentKey kid="681e5b39-49f2-4dfa-b744-86573c22e6fb"></cpix:ContentKey>
  </cpix:ContentKeyList>
  <cpix:DRMSystemList>
      <!-- Common encryption / MSS (Playready) -->
      <cpix:DRMSystem kid="681e5b39-49f2-4dfa-b744-86573c22e6fb" systemId="9a04f079-9840-4286-ab92-e65be0885f95" />
      <!-- Common encryption (Widevine)-->
      <cpix:DRMSystem kid="681e5b39-49f2-4dfa-b744-86573c22e6fb" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed" />
  </cpix:DRMSystemList>
</cpix:CPIX>
  • <cpix:CPIX id="": Enter a unique ID for the content to be packaged. In the case of single-key packaging, only this part in the above example needs to be modified.
  • kid: Used to identify the key to be issued for each track during multi-key packaging. You can enter any value for single key packaging, because the kid value in request data is not used.
  • systemId: Enter a unique uuid value specified for each DRM. (case insensitive)
Response
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cpix:CPIX id="cpix-test-cid" xmlns:cpix="urn:dashif:org:cpix" xmlns:speke="urn:aws:amazon:com:speke" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" >
   <cpix:ContentKeyList>
       <cpix:ContentKey explicitIV="MDEyMzQ1Njc4OWFiY2RlZg==" kid="12ea753c-23e7-bc02-4474-b2b976c43beb">
           <cpix:Data>
               <pskc:Secret>
                   <pskc:PlainValue>SzC1qc1cEpyFU6t/lL7Byw==</pskc:PlainValue>
               </pskc:Secret>
           </cpix:Data>
       </cpix:ContentKey>
   </cpix:ContentKeyList>
   <cpix:DRMSystemList>
       <!-- Common encryption / MSS (Playready) -->
       <cpix:DRMSystem kid="12ea753c-23e7-bc02-4474-b2b976c43beb" systemId="9a04f079-9840-4286-ab92-e65be0885f95">
            <cpix:ContentProtectionData>qAUAAAEAAQCeB...A=</cpix:ContentProtectionData><!-- Added to V2 -->
           <cpix:PSSH>AAACwnBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAAqKiAgAAAQABAJgCPABXAFIATQBIAEUAQQBEAEUAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZAB5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAwACIAPgA8AEQAQQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAEsARQBZAEwARQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQAUgA8AC8AQQBMAEcASQBEAD4APAAvAFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBJAEQAPgBQAEgAWABxAEUAdQBjAGoAQQByAHgARQBkAEwASwA1AGQAcwBRADcANgB3AD0APQA8AC8ASwBJAEQAPgA8AEMASABFAEMASwBTAFUATQA+AC8ARgA3AEIAMQBmAEgAMgBlADAAYwA9ADwALwBDAEgARQBDAEsAUwBVAE0APgA8AEwAQQBfAFUAUgBMAD4AaAB0AHQAcABzADoALwAvAHQAZQBzAHQAdABvAGsAeQBvAC4AcABhAGwAbAB5AGMAbwBuAC4AYwBvAG0ALwByAGkALwBwAGwAYQB5AHIAZQBhAGQAeQAvAGwAaQBjAGUAbgBzAGUATQBhAG4AYQBnAGUAcgAuAGQAbwA8AC8ATABBAF8AVQBSAEwAPgA8AC8ARABBAFQAQQA+ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA==</cpix:PSSH>
       </cpix:DRMSystem>
       <!-- Common encryption (Widevine)-->
       <cpix:DRMSystem kid="12ea753c-23e7-bc02-4474-b2b976c43beb" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
            <cpix:ContentProtectionData>qAUAAAEAAQCeB...A=</cpix:ContentProtectionData><!-- Added to V2 -->       
           <cpix:PSSH>AAAAVXBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADUIARIQEup1PCPnvAJEdLK5dsQ76xoMaW5rYWVudHdvcmtzIg1jcGl4LXRlc3QtY2lkKgJIRA==</cpix:PSSH>
       </cpix:DRMSystem>
   </cpix:DRMSystemList>
</cpix:CPIX>
  • <cpix:CPIX id="": The CID value entered in the request data is returned.
  • <cpix:ContentKey>: The key(<pskc:PlainValue>) and IV(explicitIV) to be used for content encryption, and the kid value for the key are returned. The value of `kid' is newly generated by KMS, independent of the value entered in the request data. The key and IV are returned in Base64 encoded form.
  • <cpix:DRMSystem>: PSSH data for each DRM(PlayReady and Widevine) is returned. The <cpix:PSSH> tag shows the default PSSH value, and the <cpix:ContentProtectionData> tag shows the PSSH data with the header part removed.

Example for HLS VOD content

Request body
<?xml version="1.0" encoding="UTF-8"?>
<cpix:CPIX id="your-content-id" xmlns:cpix="urn:dashif:org:cpix" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" xmlns:speke="urn:aws:amazon:com:speke">
 <cpix:ContentKeyList>
     <cpix:ContentKey kid="681e5b39-49f2-4dfa-b744-86573c22e6fb"></cpix:ContentKey>
 </cpix:ContentKeyList>
 <cpix:DRMSystemList>
    <!-- HLS SAMPLE-AES (FairPlay) -->
    <cpix:DRMSystem kid="681e5b39-49f2-4dfa-b744-86573c22e6fb" systemId="94ce86fb-07ff-4f43-adb8-93d2fa968ca2" />
 </cpix:DRMSystemList>
</cpix:CPIX>
  • <cpix:CPIX id="": Enter a unique ID for the content to be packaged. In the case of single-key packaging, only this part in the above example needs to be modified.
  • kid: Used to identify the key to be issued for each track during multi-key packaging. You can enter any value for single key packaging, because the kid value in request data is not used.
  • systemId: Enter a unique uuid value specified for FairPlay DRM. (case insensitive)
Response
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cpix:CPIX id="cpix-test-cid" xmlns:cpix="urn:dashif:org:cpix" xmlns:speke="urn:aws:amazon:com:speke" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" >
    <cpix:ContentKeyList>
        <cpix:ContentKey explicitIV="MDEyMzQ1Njc4OWFiY2RlZg==" kid="12ea753c-23e7-bc02-4474-b2b976c43beb">
            <cpix:Data>
                <pskc:Secret>
                    <pskc:PlainValue>ODQ4REQwMTM5OURGNDczQQ==</pskc:PlainValue>
                </pskc:Secret>
            </cpix:Data>
        </cpix:ContentKey>
    </cpix:ContentKeyList>
    <cpix:DRMSystemList>
        <!-- HLS SAMPLE-AES (FairPlay) -->
        <cpix:DRMSystem kid="12ea753c-23e7-bc02-4474-b2b976c43beb" systemId="94ce86fb-07ff-4f43-adb8-93d2fa968ca2">
            <cpix:HLSSignalingData>I0VYVC1YLUtFWTpN...DA1</cpix:HLSSignalingData><!-- Added to V2  -->
            <cpix:HLSSignalingData playlist="master">I0VYVC1YLVNFU...DU=</cpix:HLSSignalingData><!-- Added to V2 -->
            <cpix:URIExtXKey>c2tkOi8vRXVwMVBDUG52QUpFZExLNWRzUTc2dz09</cpix:URIExtXKey>
        </cpix:DRMSystem>
    </cpix:DRMSystemList>
</cpix:CPIX>
  • <cpix:CPIX id="": The CID value entered in the request data is returned.
  • <cpix:ContentKey>: The key(<pskc:PlainValue>) and IV(explicitIV) to be used for content encryption, and the kid value for the key are returned. The value of `kid' is newly generated by KMS, independent of the value entered in the request data. The key and IV are returned in Base64 encoded form.
  • <cpix:URIExtXKey>: The skd:// URI value to be included in the URI parameter for the #EXT-X-KEY tag of m3u8 is returned in Base64 encoded form.

Example for DASH live content

For live content, the API responds with a key value that is rotated according to the ContentKeyPeriodList index value.

Request body
<?xml version="1.0" encoding="UTF-8"?>
<cpix:CPIX id="cpix-test-cid" xmlns:cpix="urn:dashif:org:cpix" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" xmlns:speke="urn:aws:amazon:com:speke">
	<cpix:ContentKeyList>
		<cpix:ContentKey kid="ca65e643-482c-4a21-a204-05570a1e276c"></cpix:ContentKey>
	</cpix:ContentKeyList>
	<cpix:DRMSystemList>
	    <!-- Common encryption / MSS (Playready) -->
		<cpix:DRMSystem kid="ca65e643-482c-4a21-a204-05570a1e276c" systemId="9a04f079-9840-4286-ab92-e65be0885f95" />
		<!-- Common encryption (Widevine)-->
		<cpix:DRMSystem kid="681e5b39-49f2-4dfa-b744-86573c22e6fb" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed" />
	</cpix:DRMSystemList>
	<cpix:ContentKeyPeriodList>
		<cpix:ContentKeyPeriod id="keyPeriod_e7c4423c-a2c6-46f4-bef3-2bfed6bae9c9" index="128"/>
	</cpix:ContentKeyPeriodList>
	<cpix:ContentKeyUsageRuleList>
            <cpix:ContentKeyUsageRule intendedTrackType="HD" kid="ca65e643-482c-4a21-a204-05570a1e276c"><!-- Added to V2: intendedTrackType -->
                <cpix:KeyPeriodFilter periodId="keyPeriod_e7c4423c-a2c6-46f4-bef3-2bfed6bae9c9"/>
                <cpix:VideoFilter maxPixels="2073600" minPixels="921600"/><!-- Added to V2 -->
            </cpix:ContentKeyUsageRule>
	</cpix:ContentKeyUsageRuleList>
</cpix:CPIX>
Response
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cpix:CPIX id="cpix-test-cid" xmlns:cpix="urn:dashif:org:cpix" xmlns:speke="urn:aws:amazon:com:speke" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" >
    <cpix:ContentKeyList>
        <cpix:ContentKey explicitIV="S2ljHDlFRStjCuOpN8I7+w==" kid="6bac8ec3-0ee3-379f-3d21-290b3a2bc9c3">
            <cpix:Data>
                <pskc:Secret>
                    <pskc:PlainValue>OlRFK6LSytFr2HnN1HqwWw==</pskc:PlainValue>
                </pskc:Secret>
            </cpix:Data>
        </cpix:ContentKey>
    </cpix:ContentKeyList>
    <cpix:ContentKeyPeriodList>
        <cpix:ContentKeyPeriod id="keyPeriod_e7c4423c-a2c6-46f4-bef3-2bfed6bae9c9" index="128"/>
    </cpix:ContentKeyPeriodList>
    <cpix:ContentKeyUsageRuleList>
        <cpix:ContentKeyUsageRule intendedTrackType="HD" kid="6bac8ec3-0ee3-379f-3d21-290b3a2bc9c3"><!-- Added to V2 : intendedTrackType -->
            <cpix:KeyPeriodFilter periodId="keyPeriod_e7c4423c-a2c6-46f4-bef3-2bfed6bae9c9"/>
            <cpix:VideoFilter maxPixels="2073600" minPixels="921600"/><!-- Added to V2 -->
        </cpix:ContentKeyUsageRule>
    </cpix:ContentKeyUsageRuleList>
    <cpix:DRMSystemList>
        <cpix:DRMSystem kid="6bac8ec3-0ee3-379f-3d21-290b3a2bc9c3" systemId="9a04f079-9840-4286-ab92-e65be0885f95">
            <cpix:ContentProtectionData>qAUAAAEAAQCeB...A=</cpix:ContentProtectionData><!-- Added to V2 -->
            <cpix:PSSH>AAADTHBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAAywsAwAAAQABACIDPABXAFIATQBIAEUAQQBEAEUAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZAB5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAwACIAPgA8AEQAQQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAEsARQBZAEwARQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQAUgA8AC8AQQBMAEcASQBEAD4APAAvAFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBJAEQAPgB3ADQANgBzAGEAKwBNAE8AbgB6AGMAOQBJAFMAawBMAE8AaQB2AEoAdwB3AD0APQA8AC8ASwBJAEQAPgA8AEMASABFAEMASwBTAFUATQA+ADYAaQBiAFAANAAwAHUAVABPAFoAMAA9ADwALwBDAEgARQBDAEsAUwBVAE0APgA8AEwAQQBfAFUAUgBMAD4AaAB0AHQAcABzADoALwAvAHQAZQBzAHQAdABvAGsAeQBvAC4AcABhAGwAbAB5AGMAbwBuAC4AYwBvAG0ALwByAGkALwBwAGwAYQB5AHIAZQBhAGQAeQAvAGwAaQBjAGUAbgBzAGUATQBhAG4AYQBnAGUAcgAuAGQAbwA8AC8ATABBAF8AVQBSAEwAPgA8AEMAVQBTAFQATwBNAEEAVABUAFIASQBCAFUAVABFAFMAPgA8AFAARQBSAEkATwBEAF8ASQBOAEQARQBYAD4AMQAyADgAPAAvAFAARQBSAEkATwBEAF8ASQBOAEQARQBYAD4APAAvAEMAVQBTAFQATwBNAEEAVABUAFIASQBCAFUAVABFAFMAPgA8AC8ARABBAFQAQQA+ADwALwBXAFIATQBIAEUAQQBEAEUAUgA+AA==</cpix:PSSH>
        </cpix:DRMSystem>
        <cpix:DRMSystem kid="6bac8ec3-0ee3-379f-3d21-290b3a2bc9c3" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
            <cpix:ContentProtectionData>qAUAAAEAAQCeB...A=</cpix:ContentProtectionData><!-- Added to V2 -->        
            <cpix:PSSH>AAAAaHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAAEgIARIQa6yOww7jN589ISkLOivJwxoMaW5rYWVudHdvcmtzIh1jcGl4LXRlc3QtY2lkMDAwMDAwMDAwMDAwMDA4MCoCSEQ4gAE=</cpix:PSSH>
        </cpix:DRMSystem>
    </cpix:DRMSystemList>
</cpix:CPIX>

Example for HLS live content

Request body
<?xml version="1.0" encoding="UTF-8"?>
<cpix:CPIX id="your-content-id" xmlns:cpix="urn:dashif:org:cpix" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" xmlns:speke="urn:aws:amazon:com:speke">
 <cpix:ContentKeyList>
     <cpix:ContentKey kid="681e5b39-49f2-4dfa-b744-86573c22e6fb"></cpix:ContentKey>
 </cpix:ContentKeyList>
 <cpix:DRMSystemList>
    <!-- HLS SAMPLE-AES (FairPlay) -->
    <cpix:DRMSystem kid="681e5b39-49f2-4dfa-b744-86573c22e6fb" systemId="94ce86fb-07ff-4f43-adb8-93d2fa968ca2">
        <cpix:ContentProtectionData />
        <cpix:PSSH />
        <cpix:URIExtXKey />
    </cpix:DRMSystem>
 </cpix:DRMSystemList>
</cpix:CPIX>
Response
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cpix:CPIX id="cpix-test-cid" xmlns:cpix="urn:dashif:org:cpix" xmlns:speke="urn:aws:amazon:com:speke" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" >
    <cpix:ContentKeyList>
        <cpix:ContentKey explicitIV="S2ljHDlFRStjCuOpN8I7+w==" kid="6bac8ec3-0ee3-379f-3d21-290b3a2bc9c3">
            <cpix:Data>
                <pskc:Secret>
                    <pskc:PlainValue>OlRFK6LSytFr2HnN1HqwWw==</pskc:PlainValue>
                </pskc:Secret>
            </cpix:Data>
        </cpix:ContentKey>
    </cpix:ContentKeyList>
    <cpix:ContentKeyPeriodList>
        <cpix:ContentKeyPeriod id="keyPeriod_e7c4423c-a2c6-46f4-bef3-2bfed6bae9c9" index="128"/>
    </cpix:ContentKeyPeriodList>
    <cpix:ContentKeyUsageRuleList>
        <cpix:ContentKeyUsageRule intendedTrackType="HD" kid="6bac8ec3-0ee3-379f-3d21-290b3a2bc9c3"><!-- Added to V2: intendedTrackType -->
            <cpix:KeyPeriodFilter periodId="keyPeriod_e7c4423c-a2c6-46f4-bef3-2bfed6bae9c9"/>
            <cpix:VideoFilter maxPixels="2073600" minPixels="921600"/><!-- Added to V2 -->
        </cpix:ContentKeyUsageRule>
    </cpix:ContentKeyUsageRuleList>
    <cpix:DRMSystemList>
        <!-- HLS SAMPLE-AES (FairPlay) -->
        <cpix:DRMSystem kid="6bac8ec3-0ee3-379f-3d21-290b3a2bc9c3" systemId="94ce86fb-07ff-4f43-adb8-93d2fa968ca2">
            <cpix:HLSSignalingData>I0VYVC1YLUtFWTpN...DA1</cpix:HLSSignalingData><!-- Added to V2 -->
            <cpix:HLSSignalingData playlist="master">I0VYVC1YLVNFU...DU=</cpix:HLSSignalingData><!-- Added to V2 -->
            <cpix:URIExtXKey>c2tkOi8vY3BpeC10ZXN0LWNpZDAwMDAwMDAwMDAwMDAwODA=</cpix:URIExtXKey>
        </cpix:DRMSystem>
    </cpix:DRMSystemList>
</cpix:CPIX>

Integration with third-party solutions via PallyCon CPIX API

Nginx real-time packaging integration

If you want to process real-time packaging through Nginx VOD Module, you can develop a client module that calls PallyCon CPIX API to integrate DRM encryption.

Enter the encryption key(<pskc:PlainValue>), IV(explicitIV), kid, and PSSH values of the CPIX response data to the JSON parameter of the guide linked above. For the Nginx integration, the PSSH value must be entered as the value of the <cpix:ContentProtectionData> tag, and the kid value must be entered after converting the uuid string into a Base64-encoded 128-bit binary value.

Flussonic Media Server Integration

Flussonic Media Server is a server software that helps you capture, transcode, record, protect, and deliver video to users across multiple devices. Flussonic Media Server is integrated with PallyCon Multi-DRM service using PallyCon CPIX API.

SPEKE API

Secure Packager and Encoder Key Exchange (SPEKE) API is the CPIX API implemented by AWS Elemental and is used to interface with AWS Elemental MediaPackage or MediaConvert products. The basic specification is the same as the PallyCon CPIX API except the KMS URL. For details on SPEKE integration, please refer to the guide.

KMS URL Specification

KMS URL specification for SPEKE API is as follows. The enc-token at the end of the URL is an API authentication token that is generated when you sign up PallyCon service, and can be found on the PallyCon Console site.

https://kms.pallycon.com/cpix/getKey?enc-token={enc-token}

ATEME NEA-DVR CPIX API

CPIX API for integration with ATEME (formaly Anevia) NEA-DVR solution. PallyCon multi-DRM packaging can be integrated through this API.

This API only supports NEA-DVR solution integration and is not compatible with other ATEME solutions such as TITAN Live or TITAN File. Please contact us via HelpDesk if you want to integrate DRM packaging with ATEME TITAN solution.

Supported Features

Multi-DRM integration via ATEME NEA-DVR CPIX API supports the following content types and functions.

PlayReady Widevine FairPlay AES-128
DASH
HLS

KMS URL Specification

The KMS URL specification for ATEME NEA-DVR CPIX API is as follows. The URL generated according to the following specifications is called by the NEA-DVR solution in GET method to get the key.

https://kms.pallycon.com/cpix/anevia/{streamingFormat}/{encToken}/{cid}
Path Description
streamFormat dash or hls. The key is issued with the drm type supported according to the streaming format type.
encToken The API authentication token that is created when you sign up for the PallyCon service. You can find it on PallyCon Console site.
cid Content ID

ATEME NEA-DVR CPIX API Example

Request URL Example

https://kms.pallycon.com/cpix/anevia/dash/eyJzaXRlX2lkIjoiREVNTyIsICJhY2Nlc3Nfa2V5IjoiZHNJb2xjN2gxRzhUVW1JMTdiWXd4aFV1TkZvRmNlNzJjeDllTU9rNjJ3YjhWTjJQZGdwV1lISXhTRVg5ZjBIaSJ9/test-cid

Response Data Example

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<cpix:CPIX id="test-cid" xmlns:cpix="urn:dashif:org:cpix" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" xmlns:ns3="urn:aws:amazon:com:speke" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <cpix:ContentKeyList>
        <cpix:ContentKey explicitIV="MDEyMzQ1Njc4OWFiY2RlZg==" kid="cbc2eedd-4284-fd94-c17b-0d6fb56c146b">
            <cpix:Data>
                <pskc:Secret>
                    <pskc:PlainValue>dLlreLqTHdROTxGnw/3G7g==</pskc:PlainValue>
                </pskc:Secret>
            </cpix:Data>
        </cpix:ContentKey>
    </cpix:ContentKeyList>
    <cpix:DRMSystemList>
        <cpix:DRMSystem kid="cbc2eedd-4284-fd94-c17b-0d6fb56c146b" systemId="9a04f079-9840-4286-ab92-e65be0885f95">
            <cpix:PSSH>AAACvnBzc2gAAAAAmgTweZhAQoarkuZb4IhflQAAAp6eAgAAAQABAJQCPABXAFIATQBIAEUAQQBEAEUAUgAgAHgAbQBsAG4AcwA9ACIAaAB0AHQAcAA6AC8ALwBzAGMAaABlAG0AYQBzAC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvAEQAUgBNAC8AMgAwADAANwAvADAAMwAvAFAAbABhAHkAUgBlAGEAZAB5AEgAZQBhAGQAZQByACIAIAB2AGUAcgBzAGkAbwBuAD0AIgA0AC4AMAAuADAALgAwACIAPgA8AEQAQQBUAEEAPgA8AFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBFAFkATABFAE4APgAxADYAPAAvAEsARQBZAEwARQBOAD4APABBAEwARwBJAEQAPgBBAEUAUwBDAFQAUgA8AC8AQQBMAEcASQBEAD4APAAvAFAAUgBPAFQARQBDAFQASQBOAEYATwA+ADwASwBJAEQAPgAzAGUANwBDAHkANABSAEMAbABQADMAQgBlAHcAMQB2AHQAVwB3AFUAYQB3AD0APQA8AC8ASwBJAEQAPgA8AEMASABFAEMASwBTAFUATQA+AFQAWABrAFkAcgAwAGQAdgBIAEgAYwA9ADwALwBDAEgARQBDAEsAUwBVAE0APgA8AEwAQQBfAFUAUgBMAD4AaAB0AHQAcABzADoALwAvAGwAaQBjAGUAbgBzAGUALgBwAGEAbABsAHkAYwBvAG4ALgBjAG8AbQAvAHIAaQAvAHAAbABhAHkAcgBlAGEAZAB5AC8AbABpAGMAZQBuAHMAZQBNAGEAbgBhAGcAZQByAC4AZABvADwALwBMAEEAXwBVAFIATAA+ADwALwBEAEEAVABBAD4APAAvAFcAUgBNAEgARQBBAEQARQBSAD4A</cpix:PSSH>
        </cpix:DRMSystem>
        <cpix:DRMSystem kid="cbc2eedd-4284-fd94-c17b-0d6fb56c146b" systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
            <cpix:PSSH>AAAAUHBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAADAIARIQy8Lu3UKE/ZTBew1vtWwUaxoMaW5rYWVudHdvcmtzIgh0ZXN0LWNpZCoCSEQ=</cpix:PSSH>
        </cpix:DRMSystem>
    </cpix:DRMSystemList>
</cpix:CPIX>
Previous
Next

Last updated on Aug 2, 2023