# List Content Key Policies

> Media API · Content Key Policies

```http
GET https://app.mk.io/api/v1/projects/{project_name}/media/contentKeyPolicies
```

## Listing, Sorting and Filtering Content Key Policies

This endpoint returns the list of content key policies in the specified project.

### Sorting

The results from this endpoint can be ordered using the `$orderby` query parameter. Specify a list of field names, separated by commas
where each one can optionally specify `asc` or `desc`.

Sorting is valid on the following fields: `created`, `createdBy`, `id`, `name`, `properties/created`, `properties/lastModified`, `properties/policyId`, `updated`, `updatedBy`

### Filtering

The `$filter` query parameter allows for content key policies to be filtered on the basis of fields in the schema using OData query syntax.
See [this document](https://learn.microsoft.com/en-us/odata/concepts/queryoptions-overview#filter) for more details on the syntax used.

Filters are valid on the following fields: `created`, `createdBy`, `createdByEmail`, `createdByName`, `id`, `name`, `properties/created`, `properties/lastModified`, `properties/policyId`, `updated`, `updatedBy`, `updatedByEmail`, `updatedByName`

### Examples:

`?$top=10` - Returns only the first 10 content key policies from the list.

`?$orderby=name desc` - Sorts content key policies by name in descending order.

`?$filter=name eq 'descriptive name'` - Returns content key policies that match the provided name.

`?$orderby=created desc` - Sorts content key policies by creation date in descending order.

`?$filter=created ge 2021-01-01T00:00:00Z` - Returns content key policies created after January 1, 2021.

RBAC Capability Required: `ams.contentkeypolicy.get`

## Authentication

- `Authorization` header — Bearer authentication of the form `Bearer <token>`.

## Path parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `project_name` | string | Yes | — |

## Query parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `$orderby` | string | No | Specifies the key by which the result collection should be ordered. |
| `$filter` | string | No | Restricts the set of items returned. |
| `$top` | string | No | Specifies a non-negative integer `n` that limits the number of items returned from a collection. The service returns the number of available items up to but not greater than the specified value `n`. |
| `$skiptoken` | string | No | Specifies a start offset to support paginated results. Use `@odata.nextLink` in the result object to enumerate the collection - it will be present only if there's more than one page of entities. |

## Example request

```bash
curl -X GET "https://app.mk.io/api/v1/projects/{project_name}/media/contentKeyPolicies" \
  -H "Authorization: Bearer <token>"
```

## Responses

### 200 — A list of content key policies.

- `@odata.nextLink` · string · Optional — @odata.nextLink URL if the page length and number of items match.
- `supplemental` · object · **Required** — Supplemental info
  - `count` · integer · **Required** — Number of items returned
  - `kind` · string · **Required** — Type of items in the list
  - `operation` · string · **Required** — Operation type. Should always say 'list'
  - `pagination` · object · **Required** — Pagination info
    - `end` · integer · **Required** — Position of the last item in the list
    - `records` · integer · **Required** — Total number of items returned in the list
    - `start` · integer · **Required** — Position of the first item in the list
    - `total` · integer · **Required** — Total number of items in the project
  - `subscription` · object · Optional — Project info
    - `id` · string · **Required** — Project ID
    - `name` · string · **Required** — Project name
- `value` · list of objects · **Required** — A list of content key policies.
  - Array items (object):
    - `id` · string · Optional — Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
    - `name` · string · Optional · _1-260 characters_ · _pattern: ^[^\^\'<>%&:\\?/*+]+$_ — The name of the resource
    - `properties` · object · **Required** — The key policy
      - `created` · string · Optional · _format: date-time_ — The creation date of the Policy
      - `description` · string · Optional · _0-1024 characters_ — A description for the Policy.
      - `fairPlayAmsCompatibility` · boolean · Optional — FairPlay AMS compatibility enabled.
      - `lastModified` · string · Optional · _format: date-time_ — The last modified date of the Policy
      - `options` · list of objects · **Required** — The Key Policy options.
        - Array items (object):
          - `configuration` · object · **Required** — The key delivery configuration.
            - One of the following variants, selected by `@odata.type`:
              - **#Microsoft.Media.ContentKeyPolicyClearKeyConfiguration** (object)
                - `@odata.type` · string · **Required** — The discriminator for derived types.
              - **#Microsoft.Media.ContentKeyPolicyFairPlayConfiguration** (object)
                - `@odata.type` · string · **Required** — The discriminator for derived types.
                - `ask` · string or null · **Required** · _format: byte_ — The key that must be used as FairPlay Application Secret key. This needs to be base64 encoded.
                - `fairPlayPfx` · string or null · **Required** — The Base64 representation of FairPlay certificate in PKCS 12 (pfx) format (including private key).
                - `fairPlayPfxPassword` · string or null · **Required** — The password encrypting FairPlay certificate in PKCS 12 (pfx) format.
                - `offlineRentalConfiguration` · object · Optional — Offline rental policy
                  - `playbackDurationSeconds` · integer · **Required** — Playback duration
                  - `storageDurationSeconds` · integer · **Required** — Storage duration
                - `rentalAndLeaseKeyType` · enum · **Required** — The rental and lease key type.
                  - Allowed values: `Unknown`, `Undefined`, `DualExpiry`, `PersistentUnlimited`, `PersistentLimited`
                - `rentalDuration` · integer · **Required** — The rental duration. Must be greater than or equal to 0.
              - **#Microsoft.Media.ContentKeyPolicyPlayReadyConfiguration** (object)
                - `@odata.type` · string · **Required** — The discriminator for derived types.
                - `licenses` · list of objects · **Required** — The PlayReady licenses.
                  - Array items (object):
                    - `allowTestDevices` · boolean · **Required** — A flag indicating whether test devices can use the license.
                    - `beginDate` · string · Optional · _format: date-time_ — The begin date of license
                    - `contentKeyLocation` · object · **Required** — The content key location.
                      - One of the following variants, selected by `@odata.type`:
                        - **#Microsoft.Media.ContentKeyPolicyPlayReadyContentEncryptionKeyFromHeader** (object)
                          - `@odata.type` · string · **Required** — The discriminator for derived types.
                        - **#Microsoft.Media.ContentKeyPolicyPlayReadyContentEncryptionKeyFromKeyIdentifier** (object)
                          - `@odata.type` · string · **Required** — The discriminator for derived types.
                          - `keyId` · string or null · **Required** · _format: uuid_ — The content key ID.
                    - `contentType` · enum · **Required** — The PlayReady content type.
                      - Allowed values: `Unknown`, `Unspecified`, `UltraVioletDownload`, `UltraVioletStreaming`
                    - `expirationDate` · string · Optional · _format: date-time_ — The expiration date of license.
                    - `gracePeriod` · string · Optional · _format: duration_ — The grace period of license.
                    - `licenseType` · enum · **Required** — The license type.
                      - Allowed values: `Unknown`, `NonPersistent`, `Persistent`
                    - `playRight` · object · Optional — The license PlayRight
                      - `agcAndColorStripeRestriction` · integer · Optional · _0 to 3_ — Configures Automatic Gain Control (AGC) and Color Stripe in the license. Must be between 0 and 3 inclusive.
                      - `allowPassingVideoContentToUnknownOutput` · enum · **Required** — Configures Unknown output handling settings of the license.
                        - Allowed values: `Unknown`, `NotAllowed`, `Allowed`, `AllowedWithVideoConstriction`
                      - `analogVideoOpl` · integer · Optional — Specifies the output protection level for compressed digital audio.
                      - `compressedDigitalAudioOpl` · integer · Optional — Specifies the output protection level for compressed digital audio.
                      - `compressedDigitalVideoOpl` · integer · Optional — Specifies the output protection level for compressed digital video.
                      - `digitalVideoOnlyContentRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license.
                      - `explicitAnalogTelevisionOutputRestriction` · object · Optional — Configures the Explicit Analog Television Output Restriction in the license. Configuration data must be between 0 and 3 inclusive.
                        - `bestEffort` · boolean · **Required** — Indicates whether this restriction is enforced on a Best Effort basis.
                        - `configurationData` · integer · **Required** · _0 to 3_ — Configures the restriction control bits. Must be between 0 and 3 inclusive.
                      - `firstPlayExpiration` · string · Optional · _format: duration_ — The amount of time that the license is valid after the license is first used to play content.
                      - `imageConstraintForAnalogComponentVideoRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license.
                      - `imageConstraintForAnalogComputerMonitorRestriction` · boolean · **Required** — Enables the Image Constraint For Analog Component Video Restriction in the license.
                      - `scmsRestriction` · integer · Optional · _0 to 3_ — Configures the Serial Copy Management System (SCMS) in the license. Must be between 0 and 3 inclusive.
                      - `uncompressedDigitalAudioOpl` · integer · Optional — Specifies the output protection level for uncompressed digital audio.
                      - `uncompressedDigitalVideoOpl` · integer · Optional — Specifies the output protection level for uncompressed digital video.
                    - `relativeBeginDate` · string · Optional · _format: duration_ — The relative begin date of license.
                    - `relativeExpirationDate` · string · Optional · _format: duration_ — The relative expiration date of license.
                    - `securityLevel` · enum · Optional — The security level.
                      - Allowed values: `Unknown`, `SL150`, `SL2000`, `SL3000`
                - `responseCustomData` · string · Optional — The custom response data.
              - **#Microsoft.Media.ContentKeyPolicyUnknownConfiguration** (object)
                - `@odata.type` · string · **Required** — The discriminator for derived types.
              - **#Microsoft.Media.ContentKeyPolicyWidevineConfiguration** (object)
                - `@odata.type` · string · **Required** — The discriminator for derived types.
                - `widevineTemplate` · string · **Required** — The Widevine template.
          - `name` · string · Optional — The Policy Option description.
          - `policyOptionId` · string · Optional · _format: uuid_ — The legacy Policy Option ID.
          - `restriction` · object · **Required** — The requirements that must be met to deliver keys with this configuration
            - One of the following variants, selected by `@odata.type`:
              - **#Microsoft.Media.ContentKeyPolicyOpenRestriction** (object)
                - `@odata.type` · string · **Required** — The discriminator for derived types.
              - **#Microsoft.Media.ContentKeyPolicyTokenRestriction** (object)
                - `@odata.type` · string · **Required** — The discriminator for derived types.
                - `alternateVerificationKeys` · list of objects · Optional — A list of alternative verification keys.
                  - Array items (object):
                    - One of the following variants, selected by `@odata.type`:
                      - **#Microsoft.Media.ContentKeyPolicyRsaTokenKey** (object)
                        - `@odata.type` · string · **Required** — The discriminator for derived types.
                        - `exponent` · string or null · **Required** · _format: byte_ — The RSA Parameter exponent
                        - `modulus` · string or null · **Required** · _format: byte_ — The RSA Parameter modulus
                      - **#Microsoft.Media.ContentKeyPolicySymmetricTokenKey** (object)
                        - `@odata.type` · string · **Required** — The discriminator for derived types.
                        - `keyValue` · string or null · **Required** · _format: byte_ — The key value of the key
                      - **#Microsoft.Media.ContentKeyPolicyX509CertificateTokenKey** (object)
                        - `@odata.type` · string · **Required** — The discriminator for derived types.
                        - `rawBody` · string or null · **Required** · _format: byte_ — The raw data field of a certificate in PKCS 12 format (X509Certificate2 in .NET)
                - `audience` · string · **Required** — The audience for the token.
                - `issuer` · string · **Required** — The token issuer.
                - `openIdConnectDiscoveryDocument` · string · Optional — The OpenID connect discovery document.
                - `primaryVerificationKey` · object or null · **Required** — The primary verification key.
                  - One of the following variants, selected by `@odata.type`:
                    - **#Microsoft.Media.ContentKeyPolicyRsaTokenKey** (object)
                      - `@odata.type` · string · **Required** — The discriminator for derived types.
                      - `exponent` · string or null · **Required** · _format: byte_ — The RSA Parameter exponent
                      - `modulus` · string or null · **Required** · _format: byte_ — The RSA Parameter modulus
                    - **#Microsoft.Media.ContentKeyPolicySymmetricTokenKey** (object)
                      - `@odata.type` · string · **Required** — The discriminator for derived types.
                      - `keyValue` · string or null · **Required** · _format: byte_ — The key value of the key
                    - **#Microsoft.Media.ContentKeyPolicyX509CertificateTokenKey** (object)
                      - `@odata.type` · string · **Required** — The discriminator for derived types.
                      - `rawBody` · string or null · **Required** · _format: byte_ — The raw data field of a certificate in PKCS 12 format (X509Certificate2 in .NET)
                - `requiredClaims` · list of objects · Optional — A list of required token claims.
                  - Array items (object):
                    - `claimType` · string · Optional — Token claim type.
                    - `claimValue` · string · Optional — Token claim value.
                - `restrictionTokenType` · enum · **Required** — The type of token.
                  - Allowed values: `Unknown`, `Swt`, `Jwt`
              - **#Microsoft.Media.ContentKeyPolicyUnknownRestriction** (object)
                - `@odata.type` · string · **Required** — The discriminator for derived types.
      - `policyId` · string · Optional · _format: uuid_ — The legacy Policy ID.
    - `systemData` · object · Optional — Metadata pertaining to creation and last modification of the resource.
      - `createdAt` · string · **Required** · _format: date-time_ — The timestamp of resource creation (UTC).
      - `createdBy` · string · **Required** — The identity that created the resource.
      - `createdByType` · enum · **Required** — The type of identity that created the resource.
        - Allowed values: `User`, `Application`, `ManagedIdentity`, `Key`
      - `internalId` · string · **Required** · _format: uuid_ — The internal ID of the resource.
      - `lastModifiedAt` · string · **Required** · _format: date-time_ — The timestamp of resource last modification (UTC).
      - `lastModifiedBy` · string · **Required** — The identity that last modified the resource.
      - `lastModifiedByType` · enum · **Required** — The type of identity that last modified the resource.
        - Allowed values: `User`, `Application`, `ManagedIdentity`, `Key`
    - `type` · string · Optional — The type of the resource. E.g. "Microsoft.Media/mediaservices/assets"

Example:

```json
{
  "@odata.nextLink": "string",
  "supplemental": {
    "count": 0,
    "kind": "string",
    "operation": "string",
    "pagination": {
      "end": 0,
      "records": 0,
      "start": 0,
      "total": 0
    },
    "subscription": {
      "id": "string",
      "name": "string"
    }
  },
  "value": [
    {
      "id": "string",
      "name": "name",
      "properties": {
        "created": "2024-01-01T00:00:00Z",
        "description": "string",
        "fairPlayAmsCompatibility": true,
        "lastModified": "2024-01-01T00:00:00Z",
        "options": [
          {
            "configuration": {
              "@odata.type": "#Microsoft.Media.ContentKeyPolicyClearKeyConfiguration"
            },
            "name": "string",
            "policyOptionId": "00000000-0000-0000-0000-000000000000",
            "restriction": {
              "@odata.type": "#Microsoft.Media.ContentKeyPolicyOpenRestriction"
            }
          }
        ],
        "policyId": "00000000-0000-0000-0000-000000000000"
      },
      "systemData": {
        "createdAt": "2024-01-01T00:00:00Z",
        "createdBy": "string",
        "createdByType": "User",
        "internalId": "00000000-0000-0000-0000-000000000000",
        "lastModifiedAt": "2024-01-01T00:00:00Z",
        "lastModifiedBy": "string",
        "lastModifiedByType": "User"
      },
      "type": "string"
    }
  ]
}
```

### 400 — Bad Request

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 401 — Unauthorized

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 403 — Forbidden

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 404 — Not Found

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 429 — Too Many Requests

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

### 500 — Internal Server Error

- `error` · object · **Required** — Pertinent information about the error
  - `code` · string · **Required** — The error code.
  - `detail` · string · **Required** — The error message.
  - `extraDetail` · map from strings to any · Optional — Extra information regarding this error.
    - `[any key]` · any — map of additional properties
- `ref` · string · **Required** — A reference to the request that caused the error.
- `status` · integer · **Required** — The HTTP status code

Example:

```json
{
  "error": {
    "code": "string",
    "detail": "string",
    "extraDetail": {
      "key": null
    }
  },
  "ref": "string",
  "status": 0
}
```

---

Source spec: `media-api` · operationId: `[get]_/api/v1/projects/{project_name}/media/contentKeyPolicies`