00px VAST callbacks check generated tracking fields.

Advisory completeness checks for the tracking and impression callback templates returned by the vendor-published VAST 4 example. Opaque path slots and the generated s field are checked only for emptiness or omission. Token validity, event acceptance, signatures, session state and private variants remain outside this profile.

What this pack matches

Hosts: 00px.net
Paths: Full path expression: ^/tracking/[^/]*/[^/]*$, Full path expression: ^/vast/pixel/[^/]*/e\.gif$
Vendor docs: wiki.00px.com.br/en/technologies/vast4

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`tag_token`	required	The published VAST example emits a nonempty opaque path slot before the event path or e.gif. This is a template-completeness advisory, not a token encoding or vendor rejection contract. Presence diagnostic severity: warning. Fix: Preserve the generated path slot from the original 00px callback template.	`vendor.adxspace-vast-tracking.param.tag_token.missing` `vendor.adxspace-vast-tracking.param.tag_token.empty`	docs
`event_path`	required	Tracking callbacks include a nonempty event path. The impression template ends in e.gif. No closed event vocabulary or event-to-VAST mapping is inferred. Presence diagnostic severity: warning. Fix: Preserve the generated callback path without removing its final component.	`vendor.adxspace-vast-tracking.param.event_path.missing` `vendor.adxspace-vast-tracking.param.event_path.empty`	docs
`s`	recommended	Every reviewed callback from the published VAST example retains a nonempty opaque s query field, including error callbacks. Its meaning, encoding, authenticity and server rejection behavior are unverified. Presence diagnostic severity: warning. Fix: Preserve the generated s field from the original callback. Do not invent or re-sign its value.	`vendor.adxspace-vast-tracking.param.s.missing` `vendor.adxspace-vast-tracking.param.s.empty`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/adxspace-vast-tracking

Try this failing payload in the playground. An example with a validation finding.

https://00px.net/tracking/x/?s=x

cargo install pixellint · npm install pixellint