I don't understand a word you've said.
See if that endpoint just hinges on that DRM token, since its crypto-secure, why check any other fields?
Spoof other fields.
10k+ 0-day exploit.
Can you make a sentence like "Microsoft will ..." or "a problem is that ..." or something?