---
title: Overview
url: https://docs.kaltura.com/docs/rich-media-cms-apis/content-management/access-control-overview
---

## Access Control Overview

The Access Control API manages content access restrictions through profiles, rules, conditions, and actions. Access control profiles are assigned to entries and enforced server-side on every playManifest, raw serve, download, and thumbnail request. Rules evaluate conditions (IP address, country, domain, user agent, authentication, scheduling, metadata) and execute actions (block, preview, limit flavors, limit delivery profiles) when conditions are met.

**Base URL:** `https://www.kaltura.com/api_v3` (may differ by region/deployment)  
**Auth:** KS passed as `ks` parameter in POST form data (see [Session Guide](/docs/getting-started/authentication/ks-overview))  
**Format:** Form-encoded POST, `format=1` for JSON responses  
**Service:** `accessControlProfile` (5 actions)

### When to Use


- **Geo-restricted content** -- Block playback outside licensed countries/regions (sports broadcasting, media licensing)  
- **Domain-locked embedding** -- Restrict video playback to specific domains (prevent unauthorized embedding)  
- **IP whitelisting** -- Allow access only from corporate networks or specific IP ranges  
- **Time-windowed availability** -- Content available only during specific scheduling windows (catch-up TV, live event replays)  
- **Device-specific restrictions** -- Different rules for mobile vs desktop, or specific device families  
- **Preview/paywall** -- Allow first N seconds of playback, then require authentication for full content  
- **Metadata-driven access** -- Dynamic rules based on entry metadata (content rating, language, format type)  
- **Download vs playback split** -- Allow streaming but block downloads, or vice versa  




### Prerequisites


- **Kaltura Session (KS):** ADMIN KS (type=2) with `ACCESS_CONTROL_BASE` permission for profile CRUD  
- **Partner ID and API credentials:** From KMC > Settings > Integration Settings  
- **Service URL:** Set `$KALTURA_SERVICE_URL` to your account's regional endpoint  




### Authentication


ADMIN KS (type=2) with `ACCESS_CONTROL_BASE` permission. Generate via `session.start` (see [Session Guide](/docs/getting-started/authentication/ks-overview)) or `appToken.startSession` (see [AppTokens Guide](/docs/getting-started/authentication/app-tokens-overview)).


```bash
export KALTURA_SERVICE_URL="https://www.kaltura.com/api_v3"
```