Stegawave API

Required Parameters

• Type: "SRT_LISTENER"

Optional Parameters

• whitelist: Array of CIDR blocks (default: ["0.0.0.0/0"])
• SrtListenerSettings: Configuration object for SRT-specific settings:
  • IngestPort: Port number (default: 5000)
  • MinLatency: Minimum latency in milliseconds (default: 2000)
  • MaxLatency: Maximum latency in milliseconds
  • PassphraseEnabled: Boolean - auto-generate 32-character alphanumeric passphrase
  • Passphrase: Explicit passphrase string (10-79 alphanumeric characters)

Passphrase Encryption

• Auto-generated: Set SrtListenerSettings.PassphraseEnabled: true to generate 32-character alphanumeric passphrase
• Explicit passphrase: Set SrtListenerSettings.Passphrase: "your-password" (10-79 characters, letters, numbers, special chars)
• No encryption: Omit passphrase fields (default)

Example (No Encryption)

{
  "Type": "SRT_LISTENER",
  "whitelist": ["0.0.0.0/0"],
  "SrtListenerSettings": {
    "IngestPort": 5000,
    "MinLatency": 2000
  }
}

Example (Auto-Generated Passphrase)

{
  "Type": "SRT_LISTENER",
  "whitelist": ["203.0.113.0/24"],
  "SrtListenerSettings": {
    "IngestPort": 9000,
    "MinLatency": 2000,
    "PassphraseEnabled": true
  }
}

Example (Explicit Passphrase)

{
  "Type": "SRT_LISTENER",
  "whitelist": ["198.51.100.0/24"],
  "SrtListenerSettings": {
    "IngestPort": 9000,
    "MinLatency": 1500,
    "PassphraseEnabled": true,
    "Passphrase": "my-secure-password-123"
  }
}

Required Parameters

• Type: "SRT_CALLER"
• remote_url: Remote SRT listener URL (format: srt://host:port or host:port)

Optional Parameters

• remote_port: Port number (default: 5000) - used if not specified in URL
• stream_id: Stream identifier for routing (alphanumeric, hyphens, underscores, max 512 chars)
• passphrase: Explicit decryption passphrase (10-79 alphanumeric characters)
• passphraseEnabled: Boolean - auto-generate passphrase for encrypted remote stream

Passphrase (Decryption)

If the remote SRT listener is encrypted, provide the decryption passphrase:

• Explicit: "passphrase": "remote-server-password"
• Auto-generate: "passphraseEnabled": true (32-character alphanumeric)

Example (Basic)

{
  "Type": "SRT_CALLER",
  "remote_url": "srt://encoder.example.com:9000"
}

Example (With Stream ID)

{
  "Type": "SRT_CALLER",
  "remote_url": "srt://encoder.example.com:9000",
  "stream_id": "primary-feed"
}

Example (With Decryption)

{
  "Type": "SRT_CALLER",
  "remote_url": "srt://encoder.example.com:9000",
  "stream_id": "encrypted-feed",
  "passphrase": "remote-encoder-password-123"
}

Required Parameters

• Type: "RIST"

Optional Parameters

• port: Ingest port (default: 5000)
• whitelist: Array of CIDR blocks (default: ["0.0.0.0/0"])

Example

{
  "Type": "RIST",
  "port": 5000,
  "whitelist": ["203.0.113.0/24"]
}

Required Parameters

• Type: "ZIXI_PUSH"
• Port: 2088 (fixed, cannot be changed)

Optional Parameters

• whitelist: Array of CIDR blocks (default: ["0.0.0.0/0"])
• encryption: Encryption configuration object (see below)

Encryption Configuration

Zixi uses algorithm-specific encryption with strict hexadecimal passphrases:

• encryption.algorithm: Required - one of aes128, aes192, aes256
• encryption.passphrase: Optional - hex string of correct length
• encryption.passphraseEnabled: Optional - auto-generate based on algorithm

Example (No Encryption)

{
  "Type": "ZIXI_PUSH",
  "port": 2088,
  "whitelist": ["0.0.0.0/0"]
}

Example (AES-256 Auto-Generated)

{
  "Type": "ZIXI_PUSH",
  "port": 2088,
  "whitelist": ["198.51.100.0/24"],
  "encryption": {
    "algorithm": "aes256",
    "passphraseEnabled": true
  }
}

Example (AES-128 Explicit Passphrase)

{
  "Type": "ZIXI_PUSH",
  "port": 2088,
  "whitelist": ["203.0.113.0/24"],
  "encryption": {
    "algorithm": "aes128",
    "passphraseEnabled": true,
    "passphrase": "0123456789ABCDEF0123456789ABCDEF"
  }
}

Note: AES-128 requires exactly 32 hex characters. AES-192 requires 48, AES-256 requires 64.

Required Parameters

• Type: "RTP"

Optional Parameters

• port: Ingest port (default: 5000)
• whitelist: Array of CIDR blocks (default: ["0.0.0.0/0"])

Example

{
  "Type": "RTP",
  "port": 5000,
  "whitelist": ["198.51.100.0/24"]
}

Required Parameters

• Type: "RTP_FEC"

Optional Parameters

• port: Ingest port (default: 5000)
• whitelist: Array of CIDR blocks (default: ["0.0.0.0/0"])

Example

{
  "Type": "RTP_FEC",
  "port": 5000,
  "whitelist": ["203.0.113.0/24"]
}

Structure

• Outputs: Array of output renditions (ABR ladder)
• vodArchive: Enable/disable automatic VOD archiving to S3

Key Concepts

• Single Output Group: User provides one output_group which gets duplicated into A/B pipelines automatically
• Segment Duration: Top-level parameter (default: 4 seconds, range: 1-30)
• Unified Framerate: All outputs in a group must use the same framerate

Minimal Example

{
  "vodArchive": false,
  "Outputs": [
    {
      "resolution": "1920x1080",
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    }
  ]
}

ABR Example (2 Renditions)

{
  "vodArchive": false,
  "Outputs": [
    {
      "OutputName": "cmaf-1080p",
      "resolution": "1920x1080",
      "FramerateNumerator": 30,
      "FramerateDenominator": 1,
      "Bitrate": 5500000,
      "AudioBitrate": 128000
    },
    {
      "OutputName": "cmaf-720p",
      "resolution": "1280x720",
      "FramerateNumerator": 30,
      "FramerateDenominator": 1,
      "Bitrate": 3200000,
      "AudioBitrate": 96000
    }
  ]
}

Required Parameters (Per Output)

• FramerateNumerator: Framerate numerator (e.g., 30 for 30fps)
• FramerateDenominator: Framerate denominator (e.g., 1 for 30fps)
• Resolution: Either:
  • resolution: String format "WIDTHxHEIGHT" (e.g., "1920x1080")
  • OR Width + Height: Separate integer fields

Optional Parameters

• VideoBitrate: Video bitrate in bps (default: 5000000)
• AudioBitrate: Audio bitrate in bps (default: 128000)
• SampleRate: Audio sample rate in Hz (default: 48000)
• OutputName: Custom name for this output
• Profile: H.264/H.265 profile (see Video Advanced tab)
• AdaptiveQuantization: AQ mode (see Video Advanced tab)

Common Framerates

• 24 fps: FramerateNumerator: 24, FramerateDenominator: 1
• 23.976 fps: FramerateNumerator: 24000, FramerateDenominator: 1001
• 30 fps: FramerateNumerator: 30, FramerateDenominator: 1
• 29.97 fps: FramerateNumerator: 30000, FramerateDenominator: 1001
• 60 fps: FramerateNumerator: 60, FramerateDenominator: 1

Important Notes

• Unified Framerate: All outputs in a group MUST use the same framerate
• String Shorthand: Bitrates support "5M", "3000k" notation (converted to integers)

Single Output Example

{
  "resolution": "1920x1080",
  "VideoBitrate": 5000000,
  "AudioBitrate": 128000,
  "SampleRate": 48000,
  "FramerateNumerator": 30,
  "FramerateDenominator": 1
}

ABR Ladder Example (4 Renditions)

{
  "Outputs": [
    {
      "Width": 3840,
      "Height": 2160,
      "VideoBitrate": 15000000,
      "AudioBitrate": 192000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    },
    {
      "resolution": "1920x1080",
      "VideoBitrate": 5000000,
      "AudioBitrate": 128000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    },
    {
      "resolution": "1280x720",
      "VideoBitrate": 2500000,
      "AudioBitrate": 128000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    },
    {
      "resolution": "854x480",
      "VideoBitrate": 1200000,
      "AudioBitrate": 96000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    }
  ]
}

Parameters

• AudioBitrate: Bitrate in bps (default: 128000)
• SampleRate: Sample rate in Hz (default: 48000)

Common Audio Bitrates

• 96 kbps: 96000 - Low quality, suitable for mobile/low bitrate tiers
• 128 kbps: 128000 - Standard quality (default, recommended)
• 192 kbps: 192000 - High quality, suitable for 4K/premium tiers
• 256 kbps: 256000 - Premium quality

Sample Rate Options

• 48000 Hz: Standard for video (default, recommended)
• 44100 Hz: CD quality
• 32000 Hz: Lower quality option

Codec

• AAC: Only supported codec (automatic, no configuration needed)

Example

{
  "AudioBitrate": 128000,
  "SampleRate": 48000
}

Codec Selection

Specify the video codec per-output. Defaults to AVC (H.264).

• "Codec": "AVC" - H.264/AVC (default, broadest compatibility)
• "Codec": "HEVC" - H.265/HEVC (better compression, ~50% bitrate savings)
• "Codec": "AV1" - AV1 (next-gen, best compression, limited player support)

Note: Each output can use a different codec. Input is always H.264.

H.264 (AVC) Profile

Set via "Profile" field in each output. Defaults to HIGH.

• "BASELINE" - Basic compatibility, lower complexity
• "MAIN" - Standard profile, good compatibility
• "HIGH" - Better compression, higher quality (default)
• "HIGH_10BIT" - 10-bit color depth
• "HIGH_422" - 4:2:2 chroma subsampling
• "HIGH_422_10BIT" - 4:2:2 with 10-bit

H.265 (HEVC) Profile

Set via "Profile" field. Defaults to MAIN.

• "MAIN" - Standard HEVC profile (default)
• "MAIN_10BIT" - 10-bit color depth

Adaptive Quantization

Set via "AdaptiveQuantization" field. Defaults to AUTO.

• "AUTO" - Automatic selection (default)
• "LOW" - Minimal adaptive quantization
• "MEDIUM" - Balanced
• "HIGH" - Aggressive quality optimization
• "HIGHER" - Very aggressive
• "MAX" - Maximum quality optimization
• "OFF" - Disabled

Advanced Codec Settings (VideoSettings)

override any codec-specific parameter via "VideoSettings" object.

{
  "resolution": "1920x1080",
  "VideoBitrate": 5000000,
  "FramerateNumerator": 30,
  "FramerateDenominator": 1,
  "VideoSettings": {
    "EntropyEncoding": "CABAC",
    "NumRefFrames": 3,
    "Slices": 4
  }
}

Warning: GOP size, GOP size units, and scene change detection are hardcoded and cannot be overridden.

Rate Control Mode

QVBR (Quality-defined Variable Bitrate) - Always used, not user-configurable.

• Your VideoBitrate value is used as the maximum bitrate
• MediaLive automatically determines optimal quality level
• Provides better quality than CBR at the same bitrate

Example (H.264 High Profile with AdaptiveQuantization)

{
  "OutputName": "1080p-high",
  "Codec": "AVC",
  "resolution": "1920x1080",
  "VideoBitrate": 5000000,
  "AudioBitrate": 128000,
  "Profile": "HIGH",
  "AdaptiveQuantization": "HIGH",
  "FramerateNumerator": 30,
  "FramerateDenominator": 1
}

Example (H.265 10-bit)

{
  "OutputName": "1080p-hevc",
  "Codec": "HEVC",
  "Width": 1920,
  "Height": 1080,
  "VideoBitrate": 3000000,
  "AudioBitrate": 128000,
  "Profile": "MAIN_10BIT",
  "FramerateNumerator": 30,
  "FramerateDenominator": 1
}

Example (Mixed Codecs ABR Ladder)

{
  "Outputs": [
    {
      "OutputName": "4k-hevc",
      "Codec": "HEVC",
      "Width": 3840,
      "Height": 2160,
      "VideoBitrate": 12000000,
      "AudioBitrate": 192000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    },
    {
      "OutputName": "1080p-avc",
      "Codec": "AVC",
      "resolution": "1920x1080",
      "VideoBitrate": 5000000,
      "AudioBitrate": 128000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    }
  ]
}

Single 1080p Output

{
  "vodArchive": false,
  "Outputs": [
    {
      "resolution": "1920x1080",
      "VideoBitrate": 5000000,
      "AudioBitrate": 128000,
      "SampleRate": 48000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    }
  ]
}

4-Tier ABR Ladder (4K to 480p)

{
  "vodArchive": false,
  "Outputs": [
    {
      "Width": 3840,
      "Height": 2160,
      "VideoBitrate": 15000000,
      "AudioBitrate": 192000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    },
    {
      "resolution": "1920x1080",
      "VideoBitrate": 5000000,
      "AudioBitrate": 128000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    },
    {
      "resolution": "1280x720",
      "VideoBitrate": 2500000,
      "AudioBitrate": 128000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    },
    {
      "resolution": "854x480",
        "VideoBitrate": 1200000,
        "AudioBitrate": 96000,
        "FramerateNumerator": 30,
        "FramerateDenominator": 1
      }
    ]
}

H.265 (HEVC) 1080p

{
  "vodArchive": false,
  "Outputs": [
    {
      "Width": 1920,
      "Height": 1080,
      "VideoBitrate": 3000000,
      "AudioBitrate": 128000,
      "SampleRate": 48000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    }
  ]
}

With VOD Archive Enabled

{
  "vodArchive": true,
  "Outputs": [
    {
      "resolution": "1920x1080",
      "VideoBitrate": 5000000,
      "AudioBitrate": 128000,
      "FramerateNumerator": 30,
      "FramerateDenominator": 1
    }
  ]
}

Note: Setting vodArchive: true automatically creates an additional archive output group that records the highest resolution stream to S3 for VOD playback.

60fps High Framerate

{
  "vodArchive": false,
  "Outputs": [
    {
      "Width": 1920,
      "Height": 1080,
      "VideoBitrate": 8000000,
      "AudioBitrate": 128000,
      "SampleRate": 48000,
      "FramerateNumerator": 60,
      "FramerateDenominator": 1
    }
  ]
}

Architecture

• Encoder encodes and sends CMAF to packager channels (A/B for redundancy)
• Packager origin endpoints package CMAF into HLS/DASH/MSS manifests
• CDN distributes manifests to players via tenant-specific domains

Basic Structure

{
  "packager": {
    "originEndpoints": [
      {
        "name": "my-endpoint",
        "ContainerType": "CMAF",
        "HlsManifests": [...],
        "DashManifests": [...],
        "StartoverWindowSeconds": 86400
      }
    ]
  }
}

Important Notes

• Segment Duration: Set globally via top-level segmentDuration parameter (not per-endpoint) for watermark extraction purposes
• Best Practice: Use single origin endpoint with multiple manifests for better performance
• Recommended: CMAF container with both HLS and DASH manifests

Available Containers

Container Selection Guide

• CMAF: Choose for modern players, supports both HLS and DASH from same segments
• TS: Choose only if you need traditional HLS for legacy devices
• ISM: Choose only for Microsoft Smooth Streaming clients

Example: CMAF with Dual Manifests

{
  "ContainerType": "CMAF",
  "HlsManifests": [
    {
      "ManifestName": "index",
      "ManifestWindowSeconds": 600
    }
  ],
  "DashManifests": [
    {
      "ManifestName": "index",
      "ManifestWindowSeconds": 600
    }
  ]
}

Manifest Name Uniqueness

When using multiple manifests of different types (HLS + DASH), you can use the same manifest name. However, if you provide the same name for multiple manifests of the same type, a number will be automatically appended to prevent conflicts.

HLS Manifests

{
  "HlsManifests": [
    {
      "ManifestName": "index",
      "ManifestWindowSeconds": 600,
      "ProgramDateTimeIntervalSeconds": 60,
      "ChildManifestName": "child"
    }
  ]
}

• ManifestName: Manifest filename without extension (default: "index")
• ManifestWindowSeconds: Duration of content in manifest (default: 360)
• ProgramDateTimeIntervalSeconds: Interval for EXT-X-PROGRAM-DATE-TIME tags (optional)
• ChildManifestName: Child manifest name for master/child setup (optional)

DASH Manifests

{
  "DashManifests": [
    {
      "ManifestName": "index",
      "ManifestWindowSeconds": 600,
      "MinUpdatePeriodSeconds": 2,
      "MinBufferTimeSeconds": 30,
      "SuggestedPresentationDelaySeconds": 10
    }
  ]
}

• ManifestName: Manifest filename without extension
• ManifestWindowSeconds: Duration of content in MPD (default: 360)
• MinUpdatePeriodSeconds: Minimum manifest refresh interval (optional)
• MinBufferTimeSeconds: Minimum player buffer requirement (optional)
• SuggestedPresentationDelaySeconds: Recommended playback delay from live edge (optional)

Extension Handling

Manifest names are provided without extensions. Packager automatically appends:

• HLS: .m3u8
• DASH: .mpd

Understanding Windows

Relationship

• StartoverWindow: Storage capacity (how much content packager keeps)
• ManifestWindow: Playback window (how much players can access in manifest)
• ManifestWindow should be ≤ StartoverWindow

Configuration Limits

Common Configurations

// Live streaming (minimal DVR)
{
  "StartoverWindowSeconds": 3600,      // 1 hour storage
  "HlsManifests": [{
    "ManifestWindowSeconds": 600        // 10 minutes in manifest
  }]
}

// Event streaming (large DVR)
{
  "StartoverWindowSeconds": 86400,     // 24 hours storage
  "HlsManifests": [{
    "ManifestWindowSeconds": 3600       // 1 hour in manifest
  }]
}

// VOD-like experience (maximum DVR)
{
  "StartoverWindowSeconds": 1209600,   // 14 days storage
  "HlsManifests": [{
    "ManifestWindowSeconds": 3600       // 1 hour in manifest
  }]
}

Cost Consideration

Larger StartoverWindow values increase packager storage costs. Choose the minimum window that meets your DVR requirements.

Segment Configuration

{
  "TsUseAudioRenditionGroup": true
}

• SegmentDuration: Segment duration - set globally via top-level segmentDuration parameter
• TsUseAudioRenditionGroup: Allow any audio rendition with any video rendition (TS only, default: true)

TsUseAudioRenditionGroup

When enabled (default), allows players to select any audio track with any video quality. This is useful for:

• Multi-language streams
• Audio description tracks
• Alternate audio formats

Note: Only applies to TS container type.

Multiple Origin Endpoints

{
  "originEndpoints": [
    {
      "name": "cmaf-endpoint",
      "ContainerType": "CMAF",
      "HlsManifests": [{"ManifestName": "index"}],
      "DashManifests": [{"ManifestName": "index"}]
    },
    {
      "name": "ts-endpoint",
      "ContainerType": "TS",
      "HlsManifests": [{"ManifestName": "index"}]
    }
  ]
}

Best Practice

Use a single origin endpoint with multiple manifests (HLS + DASH) rather than multiple endpoints. This:

• Improves cache efficiency
• Simplifies management

Overview

Enable SPEKE 2.0-based DRM encryption per origin endpoint to protect content with industry-standard DRM systems. The service proxies key requests to your configured SPEKE key server, allowing you to use providers like PallyCon, EZDRM, or custom implementations.

Note: DRM is configured per origin endpoint. You can have multiple endpoints with different DRM settings.

CMAF + Multi-DRM (Widevine + PlayReady)

Most common setup for broad device compatibility.

{
  "packager": {
    "originEndpoints": [
      {
        "name": "cmaf-hybrid",
        "ContainerType": "CMAF",
        "HlsManifests": [
          {
            "ManifestName": "index",
            "ManifestWindowSeconds": 600
          }
        ],
        "DashManifests": [
          {
            "ManifestName": "index",
            "ManifestWindowSeconds": 600
          }
        ],
        "StartoverWindowSeconds": 86400,
        "drm": {
          "resourceId": "26496802-d50e-11f0-9c0f-00155dc69aeb",
          "encryptionMethod": "CENC",
          "drmSystems": ["WIDEVINE", "PLAYREADY"],
          "keyServer": {
            "url": "https://kms.pallycon.com/v2/cpix/getKey",
            "query": {
              "enc-token": "eyJh..."
            }
          }
        }
      },
      {
        "name": "ts-hls",
        "ContainerType": "TS",
        "HlsManifests": [
          {
            "ManifestName": "index",
            "ManifestWindowSeconds": 600
          }
        ],
        "StartoverWindowSeconds": 86400
      }
    ]
  }
}

Required Fields

• resourceId: SPEKE resource identifier (must be unique and stable per asset)
• encryptionMethod: Encryption method (CENC, CBCS for CMAF; SAMPLE_AES, AES_128 for TS)
• drmSystems: Array of DRM systems (see valid combinations below)
• keyServer.url: HTTPS URL of your SPEKE-compliant key server

Valid DRM Combinations

Allowed combinations depend on ContainerType and encryptionMethod:

• CMAF + CENC: WIDEVINE, PLAYREADY, IRDETO
• CMAF + CBCS: WIDEVINE, PLAYREADY, FAIRPLAY
• TS + SAMPLE_AES: FAIRPLAY
• TS + AES_128: CLEAR_KEY_AES_128

CMAF + FairPlay

Use CBCS encryption for Apple devices.

{
  "drm": {
    "resourceId": "asset-launch2025",
    "encryptionMethod": "CBCS",
    "drmSystems": ["FAIRPLAY"],
    "keyServer": {
      "url": "https://fps.example.com/getKey",
      "headers": {
        "Authorization": "Bearer your-token"
      }
    }
  }
}

TS + FairPlay

For legacy HLS FairPlay workflows.

{
  "ContainerType": "TS",
  "drm": {
    "resourceId": "ts-fairplay-asset",
    "encryptionMethod": "SAMPLE_AES",
    "drmSystems": ["FAIRPLAY"],
    "keyServer": {
      "url": "https://fps.example.com/getKey"
    }
  }
}

Optional Fields

• keyRotationIntervalSeconds: Key rotation interval (positive integer)
• constantInitializationVector: 32 hex characters (16 bytes)
• cmafExcludeSegmentDrmMetadata: CMAF only; excludes DRM metadata from segments (boolean)
• keyServer.headers: HTTP headers sent to key server (e.g., Authorization)
• keyServer.query: Query parameters appended to key server requests

Key Server Configuration

The service proxies SPEKE requests to your key server. Use headers for authentication tokens and query for provider-specific parameters.

{
  "keyServer": {
    "url": "https://kms.pallycon.com/v2/cpix/getKey",
    "headers": {
      "Authorization": "Bearer your-api-token"
    },
    "query": {
      "site-id": "YOUR_SITE_ID",
      "enc-token": "eyJh..."
    }
  }
}

Key Rotation Example

{
  "drm": {
    "resourceId": "live-event-2025",
    "encryptionMethod": "CENC",
    "drmSystems": ["WIDEVINE", "PLAYREADY"],
    "keyRotationIntervalSeconds": 300,
    "keyServer": {
      "url": "https://kms.example.com/getKey"
    }
  }
}

Keys rotate every 300 seconds (5 minutes) for enhanced security.

CPIX Request Structure

When you configure DRM, MediaPackage automatically generates CPIX XML requests and sends them to your key server. Here's what the request looks like for the Multi-DRM example above:

<?xml version="1.0" encoding="UTF-8"?>
<cpix:CPIX xmlns:cpix="urn:dashif:org:cpix" 
           xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc"
           xmlns:speke="urn:aws:amazon:cloudfront:keyformat:speke">
  <cpix:ContentKeyList>
    <cpix:ContentKey kid="a1b2c3d4-e5f6-7890-abcd-ef1234567890" />
  </cpix:ContentKeyList>
  <cpix:DRMSystemList>
    <cpix:DRMSystem kid="a1b2c3d4-e5f6-7890-abcd-ef1234567890" 
                    systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed">
      <!-- WIDEVINE system ID -->
    </cpix:DRMSystem>
    <cpix:DRMSystem kid="a1b2c3d4-e5f6-7890-abcd-ef1234567890" 
                    systemId="9a04f079-9840-4286-ab92-e65be0885f95">
      <!-- PLAYREADY system ID -->
    </cpix:DRMSystem>
  </cpix:DRMSystemList>
  <cpix:ContentKeyUsageRuleList>
    <cpix:ContentKeyUsageRule kid="a1b2c3d4-e5f6-7890-abcd-ef1234567890">
      <cpix:KeyPeriodFilter periodId="26496802-d50e-11f0-9c0f-00155dc69aeb"/>
    </cpix:ContentKeyUsageRule>
  </cpix:ContentKeyUsageRuleList>
</cpix:CPIX>

Note: MediaPackage auto-generates the key ID (kid) and includes it in the request. Your key server receives this KID and must respond with encryption keys for that specific KID. You don't need to generate or configure the KID yourself.

Field Mapping:

• resourceId → <cpix:KeyPeriodFilter periodId="..."/>
• drmSystems: ["WIDEVINE"] → systemId="edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"
• drmSystems: ["PLAYREADY"] → systemId="9a04f079-9840-4286-ab92-e65be0885f95"
• drmSystems: ["FAIRPLAY"] → systemId="94ce86fb-07ff-4f43-adb8-93d2fa968ca2"
• keyServer.headers and keyServer.query are sent as HTTP headers and query parameters

Your key server must respond with valid CPIX containing the content keys and DRM-specific initialization data.

1. CMAF Dual Manifest (Recommended)

Single CMAF endpoint with both HLS and DASH manifests.

{
  "channel": {
    "Type": "CMAF",
    "Description": "Hybrid HLS/DASH delivery"
  },
  "originEndpoints": [{
    "name": "hybrid-endpoint",
    "ContainerType": "CMAF",
    "StartoverWindowSeconds": 86400,
    "HlsManifests": [{
      "ManifestName": "index",
      "ManifestWindowSeconds": 600,
      "ProgramDateTimeIntervalSeconds": 60
    }],
    "DashManifests": [{
      "ManifestName": "index",
      "ManifestWindowSeconds": 600,
      "MinUpdatePeriodSeconds": 2,
      "MinBufferTimeSeconds": 30
    }]
  }]
}

2. Traditional HLS (TS Container)

Legacy HLS with MPEG-TS segments for maximum compatibility.

{
  "originEndpoints": [{
    "name": "hls-legacy",
    "ContainerType": "TS",
    "StartoverWindowSeconds": 3600,
    "HlsManifests": [{
      "ManifestName": "index",
      "ManifestWindowSeconds": 360
    }],
    "TsUseAudioRenditionGroup": true
  }]
}

3. Large DVR Window (14 Days)

Maximum DVR storage for event replay.

{
  "originEndpoints": [{
    "name": "event-replay",
    "ContainerType": "CMAF",
    "StartoverWindowSeconds": 1209600,
    "HlsManifests": [{
      "ManifestName": "index",
      "ManifestWindowSeconds": 3600
    }]
  }]
}

4. Small DVR Window (1 Hour)

Minimal storage for cost optimization.

{
  "originEndpoints": [{
    "name": "live-only",
    "ContainerType": "CMAF",
    "StartoverWindowSeconds": 3600,
    "HlsManifests": [{
      "ManifestName": "index",
      "ManifestWindowSeconds": 600
    }]
  }]
}

5. Multi-Origin Setup

Multiple endpoints for different use cases (not recommended for most scenarios).

{
  "originEndpoints": [
    {
      "name": "primary-cmaf",
      "ContainerType": "CMAF",
      "StartoverWindowSeconds": 86400,
      "HlsManifests": [{"ManifestName": "index"}],
      "DashManifests": [{"ManifestName": "index"}]
    },
    {
      "name": "fallback-ts",
      "ContainerType": "TS",
      "StartoverWindowSeconds": 3600,
      "HlsManifests": [{"ManifestName": "index"}]
    }
  ]
}

Quick Reference

• Modern streaming: CMAF with HLS + DASH
• Legacy HLS: TS container
• DVR window: Balance storage cost vs. replay needs
• Manifest window: Typically 10-60 minutes (600-3600 seconds)
• Segment duration: Set globally, not per-endpoint