# ContentKeyPolicyTokenRestriction

An object that represents a token restriction. Provided token must match these requirements for successful license or key delivery.

## Properties

- **@odata.type**: string (Required)
  - The discriminator for derived types.

- **alternateVerificationKeys**: list of objects (Optional)
  - A list of alternative verification keys.

## Variants

Discriminated by `@odata.type`. Select one variant:

### Microsoft.Media.ContentKeyPolicyRsaTokenKey

An object that specifies an RSA key for token validation.

- **@odata.type**: string (Required)
  - The discriminator for derived types.

- **exponent**: string or null (Required, format: byte)
  - The RSA Parameter exponent.

- **modulus**: string or null (Required, format: byte)
  - The RSA Parameter modulus.

### Microsoft.Media.ContentKeyPolicySymmetricTokenKey

An object that specifies a symmetric key for token validation.

- **@odata.type**: string (Required)
  - The discriminator for derived types.

- **keyValue**: string or null (Required, format: byte)
  - The key value of the key.

### Microsoft.Media.ContentKeyPolicyX509CertificateTokenKey

An object that specifies a certificate for token validation.

- **@odata.type**: string (Required)
  - The discriminator for derived types.

- **rawBody**: string or null (Required, format: byte)
  - The raw data field of a certificate in PKCS 12 format (X509Certificate2 in .NET).

- **audience**: string (Required)
  - The audience for the token.

- **issuer**: string (Required)
  - The token issuer.

- **openIdConnectDiscoveryDocument**: string (Optional)
  - The OpenID connect discovery document.

- **primaryVerificationKey**: object or null (Required)
  - The primary verification key.

## Variants

Discriminated by `@odata.type`. Select one variant:

### Microsoft.Media.ContentKeyPolicyRsaTokenKey

Same as above for RSA key.

### Microsoft.Media.ContentKeyPolicySymmetricTokenKey

Same as above for Symmetric key.

### Microsoft.Media.ContentKeyPolicyX509CertificateTokenKey

Same as above for certificate key.

## requiredClaims

A list of required token claims.

### Properties

- **claimType**: string (Optional)
  - Token claim type.

- **claimValue**: string (Optional)
  - Token claim value.

- **restrictionTokenType**: enum (Required)
  - The type of token.
  - Allowed values: Unknown, Swt, Jwt