Help Center / Media / Embargoed assets / Protection modes for embargoed assets

Protection modes for embargoed assets

NOTE: The Embargoed assets feature is only available on specific plans. Reach out to your Sales representative for more information about feature availability.

This article explains the different ways the embargoed assets feature allows you to protect your assets. When enabling the feature, you can select one of the following protection modes:

  • Preparation mode - Allows you to test whether your website can function with embargoed assets, at the same time preserving normal website operation.

  • Unpublished assets protected - Allows you to protect only unpublished assets, while published assets will be fetched without signatures.

  • All assets protected - Allows you to protect both unpublished and published assets.

NOTE: By default, embargoed assets are disabled. The Content Delivery API (CDA), Content Management API (CMA), and Content Preview API (CPA), will all return normal asset URLs. All assets in your space can be fetched without signatures.

Please read below a detailed explanation of each of the modes.

Preparation mode

This mode is intended to be used if you are transitioning an existing space to use embargoed assets.

Enabling preparation mode for your space allows you to create asset keys, sign embargoed asset URLs, and retrieve asset files from signed URLs. With this you can test your website and tooling to ensure that they can function with embargoed assets.

In preparation mode, the CDA, CMA, and CPA will continue to return public asset URLs. These assets can be fetched as usual, without signatures, and your website continues to function with no change.

Once you are done with the implementation and ready to enforce secure asset URLs, you can select one of the options below.

Unpublished assets protected mode

With this mode enabled, only unpublished assets are protected.

The CDA, which returns only published content, will return public asset URLs. These assets can be fetched as usual, without signatures.

The CMA and CPA will instead return unsigned embargoed asset URLs. You must sign these URLs with a valid asset key before they can be retrieved. When this mode is enabled, any public asset URLs for unpublished assets in your space will cease functioning within 48 hours.

Important: For the purposes of embargoed assets, a particular asset (as determined by its ID) is considered published if it has been published in any environment in a space. It is important to keep this in mind when using multiple environments and/or environment aliases to prepare and publish content changes.

All assets protected mode

With this mode enabled, all assets, both published and unpublished, are protected.

All Contentful APIs (CDA, CMA, and CPA) will return unsigned embargoed asset URLs. You must sign these URLs with a valid asset key before they can be retrieved. When this mode is enabled, all public asset URLs for assets in your space will cease functioning within 48 hours.