gameruntime

Requesting licensing information

POST https://collections.mp.microsoft.com/v7.0/beneficiaries/me/keys HTTP/1.1
Accept-Encoding: gzip, deflate
MS-CV: <CV>
User-Agent: XboxGameRuntime
Authorization: WLID1.0=t=<token>
Content-Length: 1733
Content-Type: application/json; charset=UTF-8
Host: collections.mp.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache

{"serviceTicket":"<JWTToken>","publisherUserId":""}

Microsoft Store API endpoint, will check if you're able to request licensing information for a specific product. The serviceTicket is a JWT token that is generated by the Xbox Game Runtime. It contains information about the user and the application that is requesting the key. The publisherUserId is an optional field that can be used to specify the user ID of the publisher.

Header is
{
  "typ": "JWT",
  "alg": "RS256",
  "x5t": "<generated>",
  "kid": "<same generated string than x5t>"
}

Content is
{
  "aud": "https://onestore.microsoft.com",
  "iss": "https://sts.windows.net/<tenant-id>/",
  "iat": <issued at time, timestamp>,
  "nbf": <not before time, timestamp>,
  "exp": <expiration time, timestamp>,
  "aio": "<hashed string>",
  "appid": "0a25d985-441d-4523-9f75-e85a6a780e40",
  "appidacr": "2",
  "idp": "https://sts.windows.net/<tenant-id>/",
  "idtyp": "app",
  "oid": "<user object id>",
  "rh": "<hashed string>",
  "sub": "<user subject id>",
  "tid": "<tenant ? id>",
  "uti": "<hashed string>",
  "ver": "1.0",
  "xms_act_fct": "3 9", # Actor facets claim
  "xms_ftd": "<Entra-specific session, hashed string>",
  "xms_idrel": "7 10", # Relationship between the subject and the resource tenant.
  "xms_rd": "<Entra-specific, Xbox-scope session, hashed string>",
  "xms_sub_fct": "9 3" #Entra Subject facets claim
}

Public Key Signature 
{
  "e": "AQAB",
  "kty": "RSA",
  "n": "<hashed signature string, RSA AQAB>"
}

The content structure follows Microsoft Entra's Agent Token claim/revendication : https://learn.microsoft.com/en-us/entra/agent-id/agent-token-claims

answers this

{
    "key": "<JWTResult>"
}

Here, the result is a JWT token that contains the licensing information for the requested product.

Header is 
{
  "alg": "RS256",
  "kid": "1E75686D3230F06BA44FB6D2BD3CAB6D331FBA80",
  "x5t": "<hashed string>",
  "typ": "JWT"
}

Content is
{
  "http://schemas.microsoft.com/marketplace/2015/08/claims/key/clientId": "0a25d985-441d-4523-9f75-e85a6a780e40",
  "http://schemas.microsoft.com/marketplace/2015/08/claims/key/payload": "<hashed, encoded payload>",
  "http://schemas.microsoft.com/marketplace/2015/08/claims/key/userId": "<hashed user id>",
  "http://schemas.microsoft.com/marketplace/2015/08/claims/key/refreshUri": "https://collections.mp.microsoft.com/v6.0/b2b/keys/renew",
  "iat": <issued at time, timestamp>,
  "nbf": <not before time, timestamp>,
  "exp": <expiration time, timestamp>,
  "iss": "https://collections.mp.microsoft.com/v6.0/keys",
  "aud": "https://collections.mp.microsoft.com/v6.0/keys"
}

License gathering

https://learn.microsoft.com/en-us/gaming/gdk/docs/store/commerce/pc-specific-considerations/xstore-license-tokens

POST https://licensing.mp.microsoft.com/v8.0/licenseToken HTTP/1.1
Accept-Encoding: gzip, deflate
MS-CV: useless m8
User-Agent: XboxGameRuntime
Authorization: t=<token>
Content-Length: 2010
Content-Type: application/json; charset=UTF-8
Host: licensing.mp.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache

{"parentProductId":"<parentProductId>","enforceSellableBy":true,"relatedProductIds":"[<this will be filled with related product IDs, if the parent product ID is a bundle>]","customDeveloperString":"<customDeveloperString>","beneficiaries":[{"identityValue":"t=<token>","localTicketReference":"<reference>","identityType":"Msa"}]}

which will answer

{
    "licenseToken": "<JWTToken>"
}

Data Structure

the header is 

{
  "alg": "RS256",
  "kid": "2F9DAFA5EDE2B04E4A4F8D5C5AED29157171B303", <- technically shouldn't change
  "x5t": "<sounds generated>",
  "typ": "JWT"
}

the body is 

{
  "LicenseTokenClaim": "<base64>",
  "nbf": <time issued, timestamp>,
  "exp": <expiration, timestamp>,
  "iss": "LicensingFD",
  "aud": "SDK/ISV"
}

LicenseTokenClaim is a base64 encoded JSON object that contains the following fields:

{"certificateId":"<certId>","customDeveloperString":"<customDeveloperString>","licensableProducts":[<list of licensable products>],"payload":"<hashedpayload>","tokenVersion":1}

The licensableProducts is a list of all products that are part of the package, including the parent product and any related products. The payload is a hashed value that represents the license information for the package.

{"endDate":"9999-12-31T23:59:59.9999999+00:00","isShared":false,"id":"<user-product entitlement Id>","productId":"<productId>","skuId":"0010","userId":"<hashed format of UserID>"}