Update the project's stream security settings

This operation supports dashboard session-cookie authentication. Call it only from trusted server code; browsers must not manufacture or expose the session cookie.

Partial update: send only the fields that change. Domain patterns are normalized (lowercased, pasted schemes/paths stripped) and deduplicated; *.example.com matches every subdomain and the apex. The stored document is always the full effective object, and the response returns it. Enabling embedTokenAuthEnabled mints the embed token key if the project has none yet. Session-cookie auth only. Rate limit: 60 requests per 60 s per session.

Error codes: unauthorized (401), not_found (404), invalid_security_settings (400), embed_tokens_unconfigured (503 — the API has no EMBED_TOKEN_KEY_MASTER).

Authentication

• sessionCookie — Dashboard session cookie set by POST /v1/auth/login. Video and playback endpoints additionally require the projectId query parameter under cookie auth.

Parameters

Request body

required

Content type: application/json

Schema: StreamSecuritySettingsPatch

{
  "allowedReferrers": [
    "*.myschool.example"
  ],
  "blockedReferrers": [
    "pirate.example"
  ],
  "blockDirectUrlAccess": true
}

Responses

Example request

{
  "allowedReferrers": [
    "*.myschool.example"
  ],
  "blockedReferrers": [
    "pirate.example"
  ],
  "blockDirectUrlAccess": true
}