Choose one encryption key mode for an Axis CMAF recording group

Bottom line: Choose one documented recording-group encryption mode, and prove authorized decryption before committing important recordings to that design.

Source fact: documented behavior

The Recording group API documentation states that only recording groups using the cmaf container format can be encrypted.

It requires either encryption.contentEncryption or encryption.keyEncryption; setting neither or both is invalid when the encryption field is supplied.

For the fixed-key mode, the key and key identifier must be agreed by the encryption and decryption sides beforehand because they are not communicated back.

What the source does not establish

Do not treat a successful recording-group configuration as proof of usable recovery. Keep this decision specific to recording-group encryption rather than SD-card formatting or a general encryption claim. Confirm exact device support, approved key handling and the intended reader’s documented capabilities. Do not infer certification, acceptable cryptographic policy or compatibility from the presence of an encryption option.

Applicability questions

• Which recording-group container and encryption mode does the design require?
• Who controls the key material and its association with the key identifier?
• Which authorized tool or integration will decrypt the retained recordings?
• Can a second authorized operator recover a disposable test recording using the documented process?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends approving the write and read sides together before enabling recording-group encryption.

1. Prepare a configuration review for a representative noncritical recording group. Record the proposed container, chosen key mode and intended decryption consumer. Mark the alternative mode as deliberately unused so a later configuration merge cannot accidentally combine both. Have the integration owner compare the actual settings with the exact documented field contract.
2. Use disposable recording content to rehearse the chosen mode. For a fixed-key proposal, arrange approved transfer or escrow of the required key and identifier without placing either secret material or full recovery instructions in an ordinary ticket. Ask a different authorized operator to follow the agreed recovery process and document whether the test recording can be retrieved and read.
3. Define the failed-recovery response before extending the configuration. If the receiving side cannot identify or use the required material, keep important recordings on the accepted workflow while the design is corrected. Review changes to the decryption consumer and key-management process as changes to the recording system, rather than assuming an unchanged camera configuration ends the review.

Verification and evidence

Retain sanitized group settings, the selected-mode decision, official support references and the disposable recording’s identity. Store evidence of the authorized recovery exercise without exposing keys. Record who performed the read-side check and which consumer version was used.

For the proposed acceptance cases, review an invalid combined-mode configuration on paper or a safe test fixture, then verify the approved single-mode configuration. Do not deliberately jeopardize required recordings to demonstrate an error. No encryption implementation, interoperability result or recovery performance is claimed by this article.

Official references

• Recording group API — Axis Communications; official VAPIX documentation.

Source review completed October 28, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings.