stream_signed_token_request

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/cloudflare/main/json-schema/cloudflare-stream-signed-token-request-schema.json",
  "title": "stream_signed_token_request",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cloudflare-accounts-api-openapi.yml#/components/schemas/stream_signed_token_request",
  "type": "object",
  "properties": {
    "accessRules": {
      "type": "array",
      "description": "The optional list of access rule constraints on the token. Access can be blocked or allowed based on an IP, IP range, or by country. Access rules are evaluated from first to last. If a rule matches, the associated action is applied and no further rules are evaluated.",
      "items": {
        "$ref": "#/$defs/stream_accessRules"
      }
    },
    "downloadable": {
      "type": "boolean",
      "description": "The optional boolean value that enables using signed tokens to access MP4 download links for a video.",
      "default": false
    },
    "exp": {
      "type": "integer",
      "description": "The optional unix epoch timestamp that specficies the time after a token is not accepted. The maximum time specification is 24 hours from issuing time. If this field is not set, the default is one hour after issuing."
    },
    "id": {
      "type": "string",
      "description": "The optional ID of a Stream signing key. If present, the `pem` field is also required."
    },
    "nbf": {
      "type": "integer",
      "description": "The optional unix epoch timestamp that specifies the time before a the token is not accepted. If this field is not set, the default is one hour before issuing."
    },
    "pem": {
      "type": "string",
      "description": "The optional base64 encoded private key in PEM format associated with a Stream signing key. If present, the `id` field is also required."
    }
  },
  "$defs": {
    "stream_accessRules": {
      "type": "object",
      "description": "Defines rules for fine-grained control over content than signed URL tokens alone. Access rules primarily make tokens conditionally valid based on user information. Access Rules are specified on token payloads as the `accessRules` property containing an array of Rule objects.",
      "properties": {
        "action": {
          "type": "string",
          "description": "The action to take when a request matches a rule. If the action is `block`, the signed token blocks views for viewers matching the rule.",
          "enum": [
            "allow",
            "block"
          ]
        },
        "country": {
          "type": "array",
          "description": "An array of 2-letter country codes in ISO 3166-1 Alpha-2 format used to match requests.",
          "items": {
            "type": "string"
          }
        },
        "ip": {
          "type": "array",
          "description": "An array of IPv4 or IPV6 addresses or CIDRs used to match requests.",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "description": "Lists available rule types to match for requests. An `any` type matches all requests and can be used as a wildcard to apply default actions after other rules.",
          "enum": [
            "any",
            "ip.src",
            "ip.geoip.country"
          ]
        }
      }
    }
  }
}