# Create > Media API · Content Key Policies ```http PUT https://app.mk.io/api/v1/projects/{project_name}/media/contentKeyPolicies/{policy_name} ``` Create a Content Key Policy RBAC Capability Required: `ams.contentkeypolicy.create` ## Authentication - `Authorization` header — Bearer authentication of the form `Bearer `. ## Path parameters | Name | Type | Required | Description | | --- | --- | --- | --- | | `project_name` | string | Yes | — | | `policy_name` | string | Yes | — | ## Request body Content type: `application/json` - `properties` · object · **Required** — The key policy - `description` · string · Optional · _0-1024 characters_ — A description for the Policy. - `fairPlayAmsCompatibility` · boolean · Optional — FairPlay AMS compatibility enabled. - `options` · list of objects · **Required** — The Key Policy options. - Array items (object): - `configuration` · object · **Required** — The key delivery configuration. - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyClearKeyConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - **#Microsoft.Media.ContentKeyPolicyFairPlayConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `ask` · string or null · **Required** · _format: byte_ — The key that must be used as FairPlay Application Secret key. This needs to be base64 encoded. - `fairPlayPfx` · string or null · **Required** — The Base64 representation of FairPlay certificate in PKCS 12 (pfx) format (including private key). - `fairPlayPfxPassword` · string or null · **Required** — The password encrypting FairPlay certificate in PKCS 12 (pfx) format. - `offlineRentalConfiguration` · object · Optional — Offline rental policy - `playbackDurationSeconds` · integer · **Required** — Playback duration - `storageDurationSeconds` · integer · **Required** — Storage duration - `rentalAndLeaseKeyType` · enum · **Required** — The rental and lease key type. - Allowed values: `Unknown`, `Undefined`, `DualExpiry`, `PersistentUnlimited`, `PersistentLimited` - `rentalDuration` · integer · **Required** — The rental duration. Must be greater than or equal to 0. - **#Microsoft.Media.ContentKeyPolicyPlayReadyConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `licenses` · list of objects · **Required** — The PlayReady licenses. - Array items (object): - `allowTestDevices` · boolean · **Required** — A flag indicating whether test devices can use the license. - `beginDate` · string · Optional · _format: date-time_ — The begin date of license - `contentKeyLocation` · object · **Required** — The content key location. - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyPlayReadyContentEncryptionKeyFromHeader** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - **#Microsoft.Media.ContentKeyPolicyPlayReadyContentEncryptionKeyFromKeyIdentifier** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `keyId` · string or null · **Required** · _format: uuid_ — The content key ID. - `contentType` · enum · **Required** — The PlayReady content type. - Allowed values: `Unknown`, `Unspecified`, `UltraVioletDownload`, `UltraVioletStreaming` - `expirationDate` · string · Optional · _format: date-time_ — The expiration date of license. - `gracePeriod` · string · Optional · _format: duration_ — The grace period of license. - `licenseType` · enum · **Required** — The license type. - Allowed values: `Unknown`, `NonPersistent`, `Persistent` - `playRight` · object · Optional — The license PlayRight - `agcAndColorStripeRestriction` · integer · Optional · _0 to 3_ — Configures Automatic Gain Control (AGC) and Color Stripe in the license. Must be between 0 and 3 inclusive. - `allowPassingVideoContentToUnknownOutput` · enum · **Required** — Configures Unknown output handling settings of the license. - Allowed values: `Unknown`, `NotAllowed`, `Allowed`, `AllowedWithVideoConstriction` - `analogVideoOpl` · integer · Optional — Specifies the output protection level for compressed digital audio. - `compressedDigitalAudioOpl` · integer · Optional — Specifies the output protection level for compressed digital audio. - `compressedDigitalVideoOpl` · integer · Optional — Specifies the output protection level for compressed digital video. - `digitalVideoOnlyContentRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license. - `explicitAnalogTelevisionOutputRestriction` · object · Optional — Configures the Explicit Analog Television Output Restriction in the license. Configuration data must be between 0 and 3 inclusive. - `bestEffort` · boolean · **Required** — Indicates whether this restriction is enforced on a Best Effort basis. - `configurationData` · integer · **Required** · _0 to 3_ — Configures the restriction control bits. Must be between 0 and 3 inclusive. - `firstPlayExpiration` · string · Optional · _format: duration_ — The amount of time that the license is valid after the license is first used to play content. - `imageConstraintForAnalogComponentVideoRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license. - `imageConstraintForAnalogComputerMonitorRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license. - `scmsRestriction` · integer · Optional · _0 to 3_ — Configures the Serial Copy Management System (SCMS) in the license. Must be between 0 and 3 inclusive. - `uncompressedDigitalAudioOpl` · integer · Optional — Specifies the output protection level for uncompressed digital audio. - `uncompressedDigitalVideoOpl` · integer · Optional — Specifies the output protection level for uncompressed digital video. - `relativeBeginDate` · string · Optional · _format: duration_ — The relative begin date of license. - `relativeExpirationDate` · string · Optional · _format: duration_ — The relative expiration date of license. - `securityLevel` · enum · Optional — The security level. - Allowed values: `Unknown`, `SL150`, `SL2000`, `SL3000` - `responseCustomData` · string · Optional — The custom response data. - **#Microsoft.Media.ContentKeyPolicyUnknownConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - **#Microsoft.Media.ContentKeyPolicyWidevineConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `widevineTemplate` · string · **Required** — The Widevine template. - `name` · string · Optional — The Policy Option description. - `restriction` · object · **Required** — The requirements that must be met to deliver keys with this configuration - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyOpenRestriction** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - **#Microsoft.Media.ContentKeyPolicyTokenRestriction** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `alternateVerificationKeys` · list of objects · Optional — A list of alternative verification keys. - Array items (object): - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyRsaTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `exponent` · string or null · **Required** · _format: byte_ — The RSA Parameter exponent - `modulus` · string or null · **Required** · _format: byte_ — The RSA Parameter modulus - **#Microsoft.Media.ContentKeyPolicySymmetricTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `keyValue` · string or null · **Required** · _format: byte_ — The key value of the key - **#Microsoft.Media.ContentKeyPolicyX509CertificateTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `rawBody` · string or null · **Required** · _format: byte_ — The raw data field of a certificate in PKCS 12 format (X509Certificate2 in .NET) - `audience` · string · **Required** — The audience for the token. - `issuer` · string · **Required** — The token issuer. - `openIdConnectDiscoveryDocument` · string · Optional — The OpenID connect discovery document. - `primaryVerificationKey` · object or null · **Required** — The primary verification key. - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyRsaTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `exponent` · string or null · **Required** · _format: byte_ — The RSA Parameter exponent - `modulus` · string or null · **Required** · _format: byte_ — The RSA Parameter modulus - **#Microsoft.Media.ContentKeyPolicySymmetricTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `keyValue` · string or null · **Required** · _format: byte_ — The key value of the key - **#Microsoft.Media.ContentKeyPolicyX509CertificateTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `rawBody` · string or null · **Required** · _format: byte_ — The raw data field of a certificate in PKCS 12 format (X509Certificate2 in .NET) - `requiredClaims` · list of objects · Optional — A list of required token claims. - Array items (object): - `claimType` · string · Optional — Token claim type. - `claimValue` · string · Optional — Token claim value. - `restrictionTokenType` · enum · **Required** — The type of token. - Allowed values: `Unknown`, `Swt`, `Jwt` - **#Microsoft.Media.ContentKeyPolicyUnknownRestriction** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. ## Example request ```bash curl -X PUT "https://app.mk.io/api/v1/projects/{project_name}/media/contentKeyPolicies/{policy_name}" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "properties": { "description": "string", "fairPlayAmsCompatibility": true, "options": [ { "configuration": { "@odata.type": "#Microsoft.Media.ContentKeyPolicyClearKeyConfiguration" }, "name": "string", "restriction": { "@odata.type": "#Microsoft.Media.ContentKeyPolicyOpenRestriction" } } ] } }' ``` ## Responses ### 201 — Create a Content Key Policy - `id` · string · Optional — Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName} - `name` · string · Optional · _1-260 characters_ · _pattern: ^[^\^\'<>%&:\\?/*+]+$_ — The name of the resource - `properties` · object · **Required** — The key policy - `created` · string · Optional · _format: date-time_ — The creation date of the Policy - `description` · string · Optional · _0-1024 characters_ — A description for the Policy. - `fairPlayAmsCompatibility` · boolean · Optional — FairPlay AMS compatibility enabled. - `lastModified` · string · Optional · _format: date-time_ — The last modified date of the Policy - `options` · list of objects · **Required** — The Key Policy options. - Array items (object): - `configuration` · object · **Required** — The key delivery configuration. - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyClearKeyConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - **#Microsoft.Media.ContentKeyPolicyFairPlayConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `ask` · string or null · **Required** · _format: byte_ — The key that must be used as FairPlay Application Secret key. This needs to be base64 encoded. - `fairPlayPfx` · string or null · **Required** — The Base64 representation of FairPlay certificate in PKCS 12 (pfx) format (including private key). - `fairPlayPfxPassword` · string or null · **Required** — The password encrypting FairPlay certificate in PKCS 12 (pfx) format. - `offlineRentalConfiguration` · object · Optional — Offline rental policy - `playbackDurationSeconds` · integer · **Required** — Playback duration - `storageDurationSeconds` · integer · **Required** — Storage duration - `rentalAndLeaseKeyType` · enum · **Required** — The rental and lease key type. - Allowed values: `Unknown`, `Undefined`, `DualExpiry`, `PersistentUnlimited`, `PersistentLimited` - `rentalDuration` · integer · **Required** — The rental duration. Must be greater than or equal to 0. - **#Microsoft.Media.ContentKeyPolicyPlayReadyConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `licenses` · list of objects · **Required** — The PlayReady licenses. - Array items (object): - `allowTestDevices` · boolean · **Required** — A flag indicating whether test devices can use the license. - `beginDate` · string · Optional · _format: date-time_ — The begin date of license - `contentKeyLocation` · object · **Required** — The content key location. - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyPlayReadyContentEncryptionKeyFromHeader** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - **#Microsoft.Media.ContentKeyPolicyPlayReadyContentEncryptionKeyFromKeyIdentifier** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `keyId` · string or null · **Required** · _format: uuid_ — The content key ID. - `contentType` · enum · **Required** — The PlayReady content type. - Allowed values: `Unknown`, `Unspecified`, `UltraVioletDownload`, `UltraVioletStreaming` - `expirationDate` · string · Optional · _format: date-time_ — The expiration date of license. - `gracePeriod` · string · Optional · _format: duration_ — The grace period of license. - `licenseType` · enum · **Required** — The license type. - Allowed values: `Unknown`, `NonPersistent`, `Persistent` - `playRight` · object · Optional — The license PlayRight - `agcAndColorStripeRestriction` · integer · Optional · _0 to 3_ — Configures Automatic Gain Control (AGC) and Color Stripe in the license. Must be between 0 and 3 inclusive. - `allowPassingVideoContentToUnknownOutput` · enum · **Required** — Configures Unknown output handling settings of the license. - Allowed values: `Unknown`, `NotAllowed`, `Allowed`, `AllowedWithVideoConstriction` - `analogVideoOpl` · integer · Optional — Specifies the output protection level for compressed digital audio. - `compressedDigitalAudioOpl` · integer · Optional — Specifies the output protection level for compressed digital audio. - `compressedDigitalVideoOpl` · integer · Optional — Specifies the output protection level for compressed digital video. - `digitalVideoOnlyContentRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license. - `explicitAnalogTelevisionOutputRestriction` · object · Optional — Configures the Explicit Analog Television Output Restriction in the license. Configuration data must be between 0 and 3 inclusive. - `bestEffort` · boolean · **Required** — Indicates whether this restriction is enforced on a Best Effort basis. - `configurationData` · integer · **Required** · _0 to 3_ — Configures the restriction control bits. Must be between 0 and 3 inclusive. - `firstPlayExpiration` · string · Optional · _format: duration_ — The amount of time that the license is valid after the license is first used to play content. - `imageConstraintForAnalogComponentVideoRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license. - `imageConstraintForAnalogComputerMonitorRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license. - `scmsRestriction` · integer · Optional · _0 to 3_ — Configures the Serial Copy Management System (SCMS) in the license. Must be between 0 and 3 inclusive. - `uncompressedDigitalAudioOpl` · integer · Optional — Specifies the output protection level for uncompressed digital audio. - `uncompressedDigitalVideoOpl` · integer · Optional — Specifies the output protection level for uncompressed digital video. - `relativeBeginDate` · string · Optional · _format: duration_ — The relative begin date of license. - `relativeExpirationDate` · string · Optional · _format: duration_ — The relative expiration date of license. - `securityLevel` · enum · Optional — The security level. - Allowed values: `Unknown`, `SL150`, `SL2000`, `SL3000` - `responseCustomData` · string · Optional — The custom response data. - **#Microsoft.Media.ContentKeyPolicyUnknownConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - **#Microsoft.Media.ContentKeyPolicyWidevineConfiguration** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `widevineTemplate` · string · **Required** — The Widevine template. - `name` · string · Optional — The Policy Option description. - `policyOptionId` · string · Optional · _format: uuid_ — The legacy Policy Option ID. - `restriction` · object · **Required** — The requirements that must be met to deliver keys with this configuration - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyOpenRestriction** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - **#Microsoft.Media.ContentKeyPolicyTokenRestriction** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `alternateVerificationKeys` · list of objects · Optional — A list of alternative verification keys. - Array items (object): - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyRsaTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `exponent` · string or null · **Required** · _format: byte_ — The RSA Parameter exponent - `modulus` · string or null · **Required** · _format: byte_ — The RSA Parameter modulus - **#Microsoft.Media.ContentKeyPolicySymmetricTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `keyValue` · string or null · **Required** · _format: byte_ — The key value of the key - **#Microsoft.Media.ContentKeyPolicyX509CertificateTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `rawBody` · string or null · **Required** · _format: byte_ — The raw data field of a certificate in PKCS 12 format (X509Certificate2 in .NET) - `audience` · string · **Required** — The audience for the token. - `issuer` · string · **Required** — The token issuer. - `openIdConnectDiscoveryDocument` · string · Optional — The OpenID connect discovery document. - `primaryVerificationKey` · object or null · **Required** — The primary verification key. - One of the following variants, selected by `@odata.type`: - **#Microsoft.Media.ContentKeyPolicyRsaTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `exponent` · string or null · **Required** · _format: byte_ — The RSA Parameter exponent - `modulus` · string or null · **Required** · _format: byte_ — The RSA Parameter modulus - **#Microsoft.Media.ContentKeyPolicySymmetricTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `keyValue` · string or null · **Required** · _format: byte_ — The key value of the key - **#Microsoft.Media.ContentKeyPolicyX509CertificateTokenKey** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `rawBody` · string or null · **Required** · _format: byte_ — The raw data field of a certificate in PKCS 12 format (X509Certificate2 in .NET) - `requiredClaims` · list of objects · Optional — A list of required token claims. - Array items (object): - `claimType` · string · Optional — Token claim type. - `claimValue` · string · Optional — Token claim value. - `restrictionTokenType` · enum · **Required** — The type of token. - Allowed values: `Unknown`, `Swt`, `Jwt` - **#Microsoft.Media.ContentKeyPolicyUnknownRestriction** (object) - `@odata.type` · string · **Required** — The discriminator for derived types. - `policyId` · string · Optional · _format: uuid_ — The legacy Policy ID. - `systemData` · object · Optional — Metadata pertaining to creation and last modification of the resource. - `createdAt` · string · **Required** · _format: date-time_ — The timestamp of resource creation (UTC). - `createdBy` · string · **Required** — The identity that created the resource. - `createdByType` · enum · **Required** — The type of identity that created the resource. - Allowed values: `User`, `Application`, `ManagedIdentity`, `Key` - `internalId` · string · **Required** · _format: uuid_ — The internal ID of the resource. - `lastModifiedAt` · string · **Required** · _format: date-time_ — The timestamp of resource last modification (UTC). - `lastModifiedBy` · string · **Required** — The identity that last modified the resource. - `lastModifiedByType` · enum · **Required** — The type of identity that last modified the resource. - Allowed values: `User`, `Application`, `ManagedIdentity`, `Key` - `type` · string · Optional — The type of the resource. E.g. "Microsoft.Media/mediaservices/assets" Example: ```json { "id": "string", "name": "name", "properties": { "created": "2024-01-01T00:00:00Z", "description": "string", "fairPlayAmsCompatibility": true, "lastModified": "2024-01-01T00:00:00Z", "options": [ { "configuration": { "@odata.type": "#Microsoft.Media.ContentKeyPolicyClearKeyConfiguration" }, "name": "string", "policyOptionId": "00000000-0000-0000-0000-000000000000", "restriction": { "@odata.type": "#Microsoft.Media.ContentKeyPolicyOpenRestriction" } } ], "policyId": "00000000-0000-0000-0000-000000000000" }, "systemData": { "createdAt": "2024-01-01T00:00:00Z", "createdBy": "string", "createdByType": "User", "internalId": "00000000-0000-0000-0000-000000000000", "lastModifiedAt": "2024-01-01T00:00:00Z", "lastModifiedBy": "string", "lastModifiedByType": "User" }, "type": "string" } ``` ### 400 — Bad Request - `error` · object · **Required** — Pertinent information about the error - `code` · string · **Required** — The error code. - `detail` · string · **Required** — The error message. - `extraDetail` · map from strings to any · Optional — Extra information regarding this error. - `[any key]` · any — map of additional properties - `ref` · string · **Required** — A reference to the request that caused the error. - `status` · integer · **Required** — The HTTP status code Example: ```json { "error": { "code": "string", "detail": "string", "extraDetail": { "key": null } }, "ref": "string", "status": 0 } ``` ### 401 — Unauthorized - `error` · object · **Required** — Pertinent information about the error - `code` · string · **Required** — The error code. - `detail` · string · **Required** — The error message. - `extraDetail` · map from strings to any · Optional — Extra information regarding this error. - `[any key]` · any — map of additional properties - `ref` · string · **Required** — A reference to the request that caused the error. - `status` · integer · **Required** — The HTTP status code Example: ```json { "error": { "code": "string", "detail": "string", "extraDetail": { "key": null } }, "ref": "string", "status": 0 } ``` ### 403 — Forbidden - `error` · object · **Required** — Pertinent information about the error - `code` · string · **Required** — The error code. - `detail` · string · **Required** — The error message. - `extraDetail` · map from strings to any · Optional — Extra information regarding this error. - `[any key]` · any — map of additional properties - `ref` · string · **Required** — A reference to the request that caused the error. - `status` · integer · **Required** — The HTTP status code Example: ```json { "error": { "code": "string", "detail": "string", "extraDetail": { "key": null } }, "ref": "string", "status": 0 } ``` ### 404 — Not Found - `error` · object · **Required** — Pertinent information about the error - `code` · string · **Required** — The error code. - `detail` · string · **Required** — The error message. - `extraDetail` · map from strings to any · Optional — Extra information regarding this error. - `[any key]` · any — map of additional properties - `ref` · string · **Required** — A reference to the request that caused the error. - `status` · integer · **Required** — The HTTP status code Example: ```json { "error": { "code": "string", "detail": "string", "extraDetail": { "key": null } }, "ref": "string", "status": 0 } ``` ### 409 — Conflict - `error` · object · **Required** — Pertinent information about the error - `code` · string · **Required** — The error code. - `detail` · string · **Required** — The error message. - `extraDetail` · map from strings to any · Optional — Extra information regarding this error. - `[any key]` · any — map of additional properties - `ref` · string · **Required** — A reference to the request that caused the error. - `status` · integer · **Required** — The HTTP status code Example: ```json { "error": { "code": "string", "detail": "string", "extraDetail": { "key": null } }, "ref": "string", "status": 0 } ``` ### 429 — Too Many Requests - `error` · object · **Required** — Pertinent information about the error - `code` · string · **Required** — The error code. - `detail` · string · **Required** — The error message. - `extraDetail` · map from strings to any · Optional — Extra information regarding this error. - `[any key]` · any — map of additional properties - `ref` · string · **Required** — A reference to the request that caused the error. - `status` · integer · **Required** — The HTTP status code Example: ```json { "error": { "code": "string", "detail": "string", "extraDetail": { "key": null } }, "ref": "string", "status": 0 } ``` ### 500 — Internal Server Error - `error` · object · **Required** — Pertinent information about the error - `code` · string · **Required** — The error code. - `detail` · string · **Required** — The error message. - `extraDetail` · map from strings to any · Optional — Extra information regarding this error. - `[any key]` · any — map of additional properties - `ref` · string · **Required** — A reference to the request that caused the error. - `status` · integer · **Required** — The HTTP status code Example: ```json { "error": { "code": "string", "detail": "string", "extraDetail": { "key": null } }, "ref": "string", "status": 0 } ``` --- Source spec: `media-api` · operationId: `[put]_/api/v1/projects/{project_name}/media/contentKeyPolicies/{policy_name}`