Viewer Protection Overrides

Viewer protection overrides let you reduce protection for one exact viewerIdentifier across a Media Protection project. They are intended for support and compatibility cases in which a known viewer must be able to start playback even when a SIEM rule would otherwise block the session or request a higher protection level.

The control is available in both Basic and Advanced Dashboard modes. Both modes manage the same project-level list of overrides.

How an Override Is Matched

An override is scoped to one project and one viewerIdentifier. Matching is:

• Exact: the complete value must match.
• Case-sensitive: Viewer-123 and viewer-123 are different identifiers.
• Project-scoped: the same identifier in another project is unaffected.
• Non-propagating: the exception is not copied to IP addresses, devices, persistent identities, viewer tags or related viewers.

Use a stable, high-entropy pseudonymous identifier, such as a secure salted hash of the viewer ID in your own platform. Do not use an email address, name or other sensitive information. Anyone who receives a valid playback token containing an overridden identifier receives the reduced-protection behavior for that project.

Evaluation Order

Fastevo evaluates an active override before SIEM:

1. The playback token and project are validated, and the content must be ready.
2. Fastevo looks for an active, non-expired override for the exact project and viewerIdentifier.
3. If one is found, Fastevo selects the reduced-protection delivery path and skips SIEM evaluation for that playback.
4. If none is found, protection levels and SIEM rules work normally.

If Fastevo cannot verify the override state when playback is initiated, it fails secure: the request stays on the normal protection and SIEM path. A lookup failure never grants reduced protection or bypasses SIEM.

As a result, an active override does not consume a SIEM rule slot, does not have a SIEM priority, does not trigger rule propagation and does not appear as an applied SIEM rule. Existing SIEM rules are not deleted or changed. They become eligible again as soon as the override is disabled or expires.

Delivery by Platform

The override selects the reduced-protection path for the viewer's platform. For non-Apple playback, this is a server-trusted decision that can force ClearKey even when the project's general ClearKey setting is off. The general ClearKey setting still gates Apple CKA, which is available only when FairPlay is fully disabled and no FairPlay ASK is configured.

Platform selection is based on the browser's playback capabilities, not only on the hardware vendor. For example, a non-Safari browser on macOS follows the non-Apple browser path when it reports the corresponding capabilities.

ClearKey Is Still Encrypted

ClearKey and CKA are reduced-protection delivery modes, but they are not the same as non-protected content. The media remains encrypted; the player receives the key material required to decrypt it.

A viewer protection override also does not create another content record or a protected/non-protected variant. It changes delivery policy for matching protected playback sessions only.

Managing Overrides in the Dashboard

In either Basic or Advanced mode, use the Viewer Protection Overrides control for the current Media Protection project.

When adding an override:

1. Enter the viewerIdentifier exactly as it appears in playback tokens.
2. Record why reduced protection is required.
3. Choose an expiration. Prefer a short, explicit support window rather than an indefinite override.
4. Review the security warning and confirm the change.

Disable the override when the compatibility or support case is resolved. Adding the same exact identifier again updates its existing project-level override instead of creating multiple competing policies.

Activation, Expiration and Running Sessions

Changes take effect on the viewer's next playback initiation. A successful write applies only to playback initiations that begin after the API returns its 2xx response; requests already in flight keep the decision they started with.

• New playback: an enabled override is evaluated before SIEM and takes effect immediately for the newly created session.
• Running playback: the session keeps the policy with which it was created. Reload the player to initiate a new session and apply the change.
• Already blocked or stopped playback: the viewer must retry or reload playback after the override is enabled.
• Disabled or expired override: the next playback returns to the normal protection and SIEM flow. A running session keeps its current policy until it is reloaded or replaced by a new session.

Expiration does not change or remove the viewerIdentifier. It only makes the override inactive. This preserves the management history and makes it possible to understand why and when reduced protection was granted.

Auditing and Observability

Creating, updating, disabling and re-enabling an override is audited separately from SIEM rule activity. The audit record identifies the project, actor, time, reason and expiration associated with the change.

Playback analytics and security telemetry may still be collected for an overridden viewer. The override suppresses SIEM enforcement for the matching playback; it is not a telemetry-retention setting. Security signals observed during the override can become relevant again after the override is disabled or expires.

API

All viewer protection override endpoints use this project-scoped base URL:

https://api.fastevo.net/api/v1/projects/mediaProtection/viewerProtectionOverrides

Authenticate with the same user or project API key used for other Media Protection project endpoints.

List and Filter Overrides

GET https://api.fastevo.net/api/v1/projects/mediaProtection/viewerProtectionOverrides
Authorization: Bearer <token-or-project-api-key>

The response uses the standard paginated shape:

{
  "currentPage": 1,
  "totalPages": 1,
  "totalRecords": 1,
  "data": [
    {
      "_id": "66b000000000000000000001",
      "viewerIdentifier": "viewer-7a4f19c2",
      "status": "active",
      "bypassesSiem": true,
      "effectiveBehavior": {
        "applePrimary": "fairplayStandard",
        "appleFallback": "clearKeyHlsWhenProjectEnabled",
        "nonApplePrimary": "clearKeyDash",
        "nonAppleFallback": "widevineStandard"
      },
      "reason": "Temporary compatibility exception",
      "expiresAt": "2026-08-12T18:00:00.000Z",
      "revokedAt": null,
      "createdByActorType": "user",
      "lastUpdatedByActorType": "user",
      "createdByUser": "66a000000000000000000001",
      "lastUpdatedByUser": "66a000000000000000000001",
      "createdAt": "2026-08-11T18:00:00.000Z",
      "updatedAt": "2026-08-11T18:00:00.000Z"
    }
  ]
}

status is computed from the stored lifecycle fields. An override is "revoked" after explicit revocation, "expired" after its expiration, and "active" otherwise.

Every public resource also includes bypassesSiem: true and an effectiveBehavior object that describes the fixed platform policy. Actor fields identify whether each change came from a "user" or "projectApiKey". User IDs are included only for user-authenticated changes; revocation fields are included after revocation. Internal project and test metadata are not part of the public item.

Get One Override

GET https://api.fastevo.net/api/v1/projects/mediaProtection/viewerProtectionOverrides/{overrideId}
Authorization: Bearer <token-or-project-api-key>

This returns the same public override resource used in the paginated data array, including its current computed status, effective behavior, reason, expiration, revocation information and actor audit fields.

Get the Delivery Summary

Use the summary endpoint to explain what an active override will do with the project's current DRM configuration:

GET https://api.fastevo.net/api/v1/projects/mediaProtection/viewerProtectionOverrides/summary
Authorization: Bearer <token-or-project-api-key>

{
  "activeCount": 4,
  "appleDeliveryMode": "fairplayStandard",
  "isFairplayOperational": true,
  "isAppleClearKeyHlsEnabled": false,
  "nonApplePrimary": "clearKeyDash",
  "nonAppleFallback": "widevineStandard"
}

appleDeliveryMode has one of these values:

The non-Apple path prefers ClearKey over DASH and falls back to Widevine at Standard protection when the client cannot use the primary path. isAppleClearKeyHlsEnabled reports whether the full Apple CKA gate is usable, not only the project's general ClearKey flag.

Create or Update an Override

PUT is idempotent for the exact project and viewerIdentifier: repeating the request updates the existing resource instead of creating duplicate policies.

PUT https://api.fastevo.net/api/v1/projects/mediaProtection/viewerProtectionOverrides
Authorization: Bearer <token-or-project-api-key>
x-otp-code: 123456
Content-Type: application/json
 
{
  "viewerIdentifier": "viewer-7a4f19c2",
  "expiresAt": "2026-08-12T18:00:00.000Z",
  "reason": "Temporary compatibility exception",
  "acknowledgeSiemBypass": true
}

The endpoint returns 201 Created when it creates the resource and 200 OK when it updates the existing exact match. The returned resource contains its computed lifecycle status.

If the Media Protection project is being deployed, deleted or is otherwise not in its deployed state, write operations return 409 Conflict with code VIEWER_PROTECTION_OVERRIDE_PROJECT_NOT_WRITABLE. Wait for the project lifecycle operation to finish before retrying. This fence prevents an override from being created or changed while the project itself is being removed.

Revoke an Override

Revocation is a soft delete: the resource and its audit history remain available, but it no longer matches future playback initiations.

DELETE https://api.fastevo.net/api/v1/projects/mediaProtection/viewerProtectionOverrides/{overrideId}
Authorization: Bearer <token-or-project-api-key>
x-otp-code: 123456
Content-Type: application/json
 
{
  "reason": "Viewer compatibility issue resolved"
}

The JSON body is required. Some HTTP clients omit bodies from DELETE requests unless explicitly configured, so verify that your client sends both Content-Type: application/json and the serialized body.

reason is required and can contain up to 500 characters.

The endpoint returns 200 OK with the revoked resource. Its status is "revoked", and its revocation reason and timestamp are retained for auditing.

Relationship to Other MP2 Features