Protect a Live stream with multi-DRM

Available in: UI · API

Use this how-to when a Live stream must reach web, Windows and Apple clients with DRM enforced on every platform. The integration model is the same regardless of the surface: register a DRM provider once, then attach it to each protected Destination.

When to use this

When a DASH, CMAF or HLS / TS Destination on a Live stream must encrypt segments and have license URLs in the manifest. For the broader concept reference see DRM.

Prerequisites

• The System Administrator role. The DRM provider CRUD is gated to that role; Operators cannot register, validate, edit or delete providers.
• A multi-DRM vendor account. The catalogue publishes AXINOM and EZDRM today. From the vendor you receive a SPEKE endpoint, the credentials envelope expected by the brand and — for brands that need it — a tenant id.
• A DASH, CMAF or HLS / TS Destination on the Live stream that will carry the protected output.

Via UI

Navigation: Integrations → DRM → Providers.

Via API

DRM provider CRUD:

The DRM block on a Destination is set through addPublishing / updatePublishing:

# 1. Register the provider
curl -X POST "https://<your-host>/c21apiv2/settings/integrations/drmproviders" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "MyDRMProvider",
    "provider_type": "AXINOM",
    "speke_url": "https://drm-axinom.example/speke/v2",
    "tenant_id": "<tenant>",
    "credentials": { "...": "..." },
    "enabled": true
  }'

# 2. Validate
curl -X POST "https://<your-host>/c21apiv2/settings/integrations/drmproviders/<providerId>/validate" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

# 3. Attach to an existing DASH/CMAF/HLS Publishing
curl -X PUT "https://<your-host>/c21apiv2/publishings/<publishingId>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "drm": {
      "active": true,
      "provider_id": <providerId>,
      "contentid": "<vendor content id>",
      "systems": ["Widevine", "PlayReady"],
      "encryption_mode": "cenc"
    }
  }'

validation_status carries UNKNOWN (just registered), VALID (validation succeeded) or INVALID (validation failed). Common patterns:

Verify

• The provider row reads Validation status: VALID.
• GET /c21apiv2/publishings/{publishingId} returns the drm block with active: true and the expected systems / encryption_mode.
• Players from each target ecosystem successfully decrypt and play the protected output:

The upstream vendor's dashboard logs one license issuance per session per ecosystem.

FAQ