<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE rfc [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">
]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.7.30 (Ruby 3.4.8) -->
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft-englishm-moq-cdn-provisioning-00" category="info" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true" version="3">
  <!-- xml2rfc v2v3 conversion 3.31.0 -->
  <front>
    <title abbrev="moq-cdn-prov">MoQ CDN Provisioning</title>
    <seriesInfo name="Internet-Draft" value="draft-englishm-moq-cdn-provisioning-00"/>
    <author fullname="Mike English">
      <organization>Cloudflare</organization>
      <address>
        <email>ietf@englishm.net</email>
      </address>
    </author>
    <date year="2026" month="March" day="01"/>
    <area>Web and Internet Transport</area>
    <workgroup>Media Over QUIC</workgroup>
    <keyword>moq</keyword>
    <keyword>cdn</keyword>
    <keyword>provisioning</keyword>
    <keyword>relay</keyword>
    <abstract>
      <?line 38?>

<t>This document describes concepts
related to provisioning MoQ relay scopes on CDN infrastructure,
including scope creation, credential-to-scope mapping,
and origin fallback configuration.
It uses a provisioning API as a vehicle
for describing these concepts
and identifying areas
where common semantics across CDN providers
may be needed for multi-CDN compatibility.</t>
    </abstract>
    <note removeInRFC="true">
      <name>About This Document</name>
      <t>
        The latest revision of this draft can be found at <eref target="https://englishm.github.io/moq-cdn-provisioning/draft-englishm-moq-cdn-provisioning.html"/>.
        Status information for this document may be found at <eref target="https://datatracker.ietf.org/doc/draft-englishm-moq-cdn-provisioning/"/>.
      </t>
      <t>
        Discussion of this document takes place on the
        Media Over QUIC Working Group mailing list (<eref target="mailto:moq@ietf.org"/>),
        which is archived at <eref target="https://mailarchive.ietf.org/arch/browse/moq/"/>.
        Subscribe at <eref target="https://www.ietf.org/mailman/listinfo/moq/"/>.
      </t>
      <t>Source for this draft and an issue tracker can be found at
        <eref target="https://github.com/englishm/moq-cdn-provisioning"/>.</t>
    </note>
  </front>
  <middle>
    <?line 50?>

<section anchor="introduction">
      <name>Introduction</name>
      <t>Media over QUIC Transport (MoQT) <xref target="MOQT"/>
defines a pub/sub protocol for media delivery through relays.
CDN providers that deploy MoQ relays
need to configure them in ways
that are roughly analogous to
the rewrite rules, origin selection,
and routing configuration
associated with HTTP reverse proxies and CDNs.
Some of these configurations
will need common semantics across providers
to support multi-CDN deployments.</t>
      <t>This document uses a provisioning API
as a vehicle for describing these concepts.
A customer creates a scope on a CDN relay,
gets back connection credentials,
and hands those credentials
to their publishers and subscribers.
The relay uses the credentials
to map incoming connections to the right scope.</t>
      <t>The API itself is part of the picture,
but the more important contribution here
is describing the underlying concepts
(scopes, credential-to-scope mapping, origin fallback)
in a way that could be consistent across CDN providers.</t>
      <t>A machine-readable OpenAPI description of the API described here
is maintained alongside this document
in the source repository (see openapi.yaml).</t>
    </section>
    <section anchor="conventions-and-definitions">
      <name>Conventions and Definitions</name>
      <t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
appear in all capitals, as shown here.</t>
      <?line -18?>

<dl>
        <dt>Scope:</dt>
        <dd>
          <t>An isolated MoQ delivery context on a relay,
as defined in <xref target="MOQT"/>.
All namespaces and tracks within a scope
are isolated from other scopes on the same relay.
A scope is the resource created by the provisioning API.</t>
        </dd>
      </dl>
    </section>
    <section anchor="scope-provisioning">
      <name>Scope Provisioning</name>
      <t>A CDN provider exposes an HTTP API endpoint
for creating scopes:</t>
      <artwork><![CDATA[
POST /moq/scopes
]]></artwork>
      <t>The request <bcp14>MAY</bcp14> include configuration
(see <xref target="origin-fallback"/>).</t>
      <t>The response includes
a server-generated scope identifier
and connection credentials:</t>
      <sourcecode type="json"><![CDATA[
{
  "scope_id": "a1b2c3d4e5f6",
  "url": "moqt://relay.example.com",
  "token": "eyJhbGciOiJFZDI1NTE5..."
}
]]></sourcecode>
      <t>The <tt>url</tt> is the base URL of the relay service.
The <tt>token</tt> is a credential
that grants access to this scope.</t>
    </section>
    <section anchor="connecting">
      <name>Connecting to a Scope</name>
      <t>Clients connect to a provisioned scope
by combining the URL and token
returned at creation time:</t>
      <artwork><![CDATA[
moqt://relay.example.com/{token}
]]></artwork>
      <t>The relay extracts the token from the URL path,
validates it,
and maps the connection
to the corresponding MoQT scope.</t>
      <t>Within that scope,
all MoQT operations (SUBSCRIBE, ANNOUNCE, etc.)
are isolated.
Publishers and subscribers in one scope
cannot see namespaces or tracks from another scope.</t>
    </section>
    <section anchor="origin-fallback">
      <name>Origin Fallback</name>
      <t>A scope <bcp14>MAY</bcp14> be configured
with an upstream origin URL.
When a subscriber requests content
that isn't available on the relay,
the relay connects to the origin to fetch it.</t>
      <t>This is configured at provisioning time:</t>
      <sourcecode type="json"><![CDATA[
{
  "config": {
    "origin_fallback": {
      "url": "moqt://origin.example.com"
    }
  }
}
]]></sourcecode>
      <t>The relay establishes a MoQT connection to the origin URL
and forwards the subscription.
The origin could be another relay
(at a different CDN provider,
or a customer's own infrastructure),
or any MoQT-speaking endpoint.</t>
    </section>
    <section anchor="security-considerations">
      <name>Security Considerations</name>
      <t>TODO</t>
    </section>
    <section anchor="iana-considerations">
      <name>IANA Considerations</name>
      <t>This document has no IANA actions.</t>
    </section>
  </middle>
  <back>
    <references anchor="sec-normative-references">
      <name>Normative References</name>
      <reference anchor="MOQT">
        <front>
          <title>Media over QUIC Transport</title>
          <author fullname="Suhas Nandakumar" initials="S." surname="Nandakumar">
            <organization>Cisco</organization>
          </author>
          <author fullname="Victor Vasiliev" initials="V." surname="Vasiliev">
            <organization>Google</organization>
          </author>
          <author fullname="Ian Swett" initials="I." surname="Swett">
            <organization>Google</organization>
          </author>
          <author fullname="Alan Frindell" initials="A." surname="Frindell">
            <organization>Meta</organization>
          </author>
          <date day="13" month="January" year="2026"/>
          <abstract>
            <t>   This document defines the core behavior for Media over QUIC Transport
   (MOQT), a media transport protocol designed to operate over QUIC and
   WebTransport, which have similar functionality.  MOQT allows a
   producer of media to publish data and have it consumed via
   subscription by a multiplicity of endpoints.  It supports
   intermediate content distribution networks and is designed for high
   scale and low latency distribution.

            </t>
          </abstract>
        </front>
        <seriesInfo name="Internet-Draft" value="draft-ietf-moq-transport-16"/>
      </reference>
      <reference anchor="RFC2119">
        <front>
          <title>Key words for use in RFCs to Indicate Requirement Levels</title>
          <author fullname="S. Bradner" initials="S." surname="Bradner"/>
          <date month="March" year="1997"/>
          <abstract>
            <t>In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="14"/>
        <seriesInfo name="RFC" value="2119"/>
        <seriesInfo name="DOI" value="10.17487/RFC2119"/>
      </reference>
      <reference anchor="RFC8174">
        <front>
          <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
          <author fullname="B. Leiba" initials="B." surname="Leiba"/>
          <date month="May" year="2017"/>
          <abstract>
            <t>RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
          </abstract>
        </front>
        <seriesInfo name="BCP" value="14"/>
        <seriesInfo name="RFC" value="8174"/>
        <seriesInfo name="DOI" value="10.17487/RFC8174"/>
      </reference>
    </references>
    <?line 199?>

<section numbered="false" anchor="acknowledgments">
      <name>Acknowledgments</name>
      <t>Thanks to Lucas Pardue and Jacob Curtis
for design input.</t>
    </section>
  </back>
  <!-- ##markdown-source:
H4sIAAAAAAAAA41Y23IbNxJ9x1dgxw+xtjSjKHGyWVY2CU3JsVySKEtUubJb
WzFmBiQRzQATAEOZy6K/Jd+yX7angRledEntg00S1+5z+nQ3lKYp88pXcsCT
C/Oej04u+ZU1C+WU0UrPEiby3MoFpmvze1qUOm0wnbBCeDkzdjngSk8NY6Up
tKhxTGnF1KdSzyrl5nW6u6s/NP3yS+bavFaOBvyywbaz08kbpts6l3bAShw+
YIXRTmrXugH3tpUMRnzNhJUCxnyQORe65GfaS6ul5xMrtGuM9Qm7N/ZuZk3b
kE+yVIKPF9Ly97dno4TdySXmywHjKYdt9AHz6GPXQvptZSWWbCF1C1s4f/ZE
zqMHyQfci738Z1pJ47VQVQTuJyX9NDN2RsPCFnMMz71v3ODoiFbRkFrIrF92
RANHuTX3Th5h/xHtmyk/b3Ps7ME9egpcWlkBP+d37uh3ZPGMTJkn9x79H+Rl
c19XCWOi9XNjCUdcyPm0raoYAMmFupP8NJ6RhEl4JLT6j/A4YsBHlWnLKXyW
YVJGmMj1nzZ2glLGtLE19iwC/hfj9xOESXoSQAqm+Z5zxigIN4tZmqZc5A7z
BeYmc+U44rOtpfa8lK6wKpeOI74K2XjHiGkvS+7NXhBwEkSIAu4K02CH0UEg
uMwKnN4WvrXyEJcXVVvSjrCOF4hRcvWQvpW4VIkq9SaNs7VoGqw9ZBS/xqqZ
0nwqqioXxR3ZNFWz1ob9GTvzvHW4WOwbNrw644JGF3KuikoyON87RvN+Lp3c
+kcXqWDHdEnTpCHH7ufS0qK6hlsOLGC+wKGFNc4FP8OdpbSO1cAgl1xLuFNy
uq1uK69SWoUTGpibq0r5ZRbBr1VZwiz2ggRqTQmkYDpjUTymF89WtfwlwJ4c
8NWKeF6vWSmnSkfP2/wI2YKs8aYwVbw+HFTKCoTbJRyG5mbzyJbL2J71mBXE
e1OZ5ZZTx8gb4rzHXBJuNdjl9zQddgEqHo6ulsg3ojIz0+JAg1lMyHurPD7b
SrrDnksnKxncjQxjtyfQ95hlwjlTqBB195AkfzuZXOE8OAPiYPknRb5jOzyB
PzemltxMt8RujwKRqqoCNc+SuSUS7rq2CYhvGYzQkDpw1QO5PBN+bDf8+J+G
X8aGvGidhws2SiOcGMUAa0WItcDJIZtJ73ivBB1x3FGRi5jO8R/RapzcnSTv
cLeyFDOUR4h8Wo/wiaK3sGYSmCNVB9+IyAdnQKGIAoDZ8dbZQbyH5eB57qMD
AS8ZBKk8mJ9ygNcIwBvZ4o3qkkTe+jBQG4SUqokCkETHe1jWBkdJkYzQ38OS
txrcVcvOmqjplzEl/XmKeZheDpCqgDfCO2qiMG1VkrCp1CrnifCn9A8vhzgU
NUrLFAyWIgfr40Zqcjxa2wQPOq+3wznCsncLiV57/MMQlKRnDodj+U64kX20
35nWFkRTY5zyaDP4SycRLbhRNCpbiro6yCi9jIxekPfEDjF9QmlDRV0EZlDv
ORV8h7p0ezNJDuMnvxyH79enyEPXpyf0/ebt8Px884V1K27ejm/PT7bftjtH
44uL08uTuBmjfG+IJRfDXzBDViXjq8nZ+HJ4nvDg4K7AKMMgrkCCol6msZKS
AvLzFj/seT26+u8fx6+QH/9y/Wb01fHx39fr7sd3x397hR9I5zreZjSSVfwJ
LJcMwSCFpVMQBrwAgJ6URBXEzc19DDug+dd/ETL/HvDv86I5fvVDN0AO7w32
mO0NBswejzzaHEF8YuiJazZo7o0/QHrf3uEve7973HcGv/+xQgTy9Pi7H39g
jN2QYNAyDPhQQ7smdgJUJTbFhSQqP/mYq7o8xQm9WKMCP33dyjAzpHSMVsg1
ouiyOHUidy6k+qDAINPQCsrtpVNram5Amd3pN4IacFi8OBzfpU4Vc5eVnVhi
aoWclzHxPMjYQS7B270Gn5S9q3UuP0FzwexYlEjKUpeNQXiGPiN2N32z44Dd
58+f2dUYkRJa1TgcBrtc+3uLbpSDGx47pQcVjAVtr1YxWaV9slqvD7L+BPQI
eAv029HRoMZZkJPOpJY2uN2BEtscJW0oFE8XkWjybw5XrwBoErb+qsoEzas4
zr8qvi5fyW+m3ybEc9LaKoldvEcnHWmQn0TdVDJDjYiLvLmTmpbJ5bt5/nOh
xurdm3+enB1fTk6/ybIsYestIh9x5Meev1zAsdvr8z51dg0n3FOFjNXqYzg9
7BA7fsQOZYYWylOlR6x1FQrr+uIUMmSAgGqJwf4YAqsXxWZ8zdioUlT9e7zi
yk0E9eiynMRQoy71lYnsDvFNBqKPRqkL2d1vemDuVS27GHkOwqNV2L/ejRkC
AaKjDj7iFJZEjfQ3o+2cH7KFqFQZmgrlY3uA8tfV9Q39XWuAERujqewa/MkG
qg9RnAHUMIbDoOSwBr+6bou/vLl9fTO6Pnt9esiHl5fj28sRvklfZAdsV84Z
u3q2CaGMAVg7VAuhtcGdEMFO2oDSuqwRfBZ6JzMEYsextr/pnw6rFw8FRNqO
siDt5VvZyZKFrhMabxs8ZKSo+1YBuGbsA4oHZamNxb2IXUyGyAQBJuX0F6hg
C3rBUkfQ5asuR26jueNh00B1d+HXFMDNQVzfdyq3YyTF0V4a28bSVrxxOaS3
Cq/JJJ79aw/CZuKRkuPCPSmHhWtG/x4Ho/Mi8kkqDFGxk132HQOIIRCRLu+F
LWMwdmg28WU32a7edGE9x/EvDy/p+cFLNZ2iPKNR2M3ShwzhITZt9RcIF9Tx
/XfpQVykw5tnkjo0AeHPE30yjwVBFi3eMEtKE9SO9W8KNhmfjMP7bXg5fDy5
18HMUQq1iStF7JS7ZyARQIcMiztt7itZzsIjg60G8S89svxHAqKcTNZ0qNB3
IUTO2wJHXgG5VgbpvBOFyfmotV65/q2rZuRw08KP/wEkWNpTxRIAAA==

-->

</rfc>
