Amplitude group updates check nested operation bounds.

Group Identify checks the documented US and EU ingestion endpoints, single or bulk identification objects and supported update operation shapes. Each operation map receives a 1,024-property bound because no individual map can exceed the request budget.

The total across operations and rows remains unverified. Several smaller maps can exceed the aggregate budget even when each local check passes. Credential validity, configured groups, rate limits and receiver acceptance require external context.

What this pack matches

Hosts: api2.amplitude.com, api.eu.amplitude.com
Paths: /groupidentify
Vendor docs: amplitude.com/docs/apis/analytics/group-identify

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`api_key`	required	It is the project API key. Amplitude documents it as required on GET query and POST form. Fix: Send `api_key` with the Amplitude project API key.	`vendor.amplitude-group-identify.param.api_key.missing` `vendor.amplitude-group-identify.param.api_key.empty`	docs
`identification`	required	It is a JSON identification object or array. Amplitude documents it as required. Each object carries group_type and group_value. Fix: Send `identification` as JSON with `group_type` and `group_value`.	`vendor.amplitude-group-identify.param.identification.missing` `vendor.amplitude-group-identify.param.identification.empty`	docs
`root`	optional	Identification is an object or array of identification objects. Decoded body source: identification. Encoding: json. Native JSON type: object or array. Minimum array items: 1. Maximum array items: 1024.	`vendor.amplitude-group-identify.body.root.invalid`	docs
`root`	optional	Each identification is an object. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: object.	`vendor.amplitude-group-identify.body.root.invalid`	docs
`group_type`	required	The vendor documents `group_type` in the request contract. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: string.	`vendor.amplitude-group-identify.body.group_type.missing` `vendor.amplitude-group-identify.body.group_type.empty` `vendor.amplitude-group-identify.body.group_type.invalid`	docs
`group_value`	required	The vendor documents `group_value` in the request contract. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: string.	`vendor.amplitude-group-identify.body.group_value.missing` `vendor.amplitude-group-identify.body.group_value.empty` `vendor.amplitude-group-identify.body.group_value.invalid`	docs
`group_properties`	optional	The vendor documents `group_properties` in the request contract. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: object. Maximum object properties: 1024.	`vendor.amplitude-group-identify.body.group_properties.invalid`	docs
`group_properties.$set`	optional	A single operation cannot exceed the published 1,024 group-property request budget. This local bound does not certify the aggregate request budget. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: object. Maximum object properties: 1024.	`vendor.amplitude-group-identify.body.group_properties.$set.invalid`	docs
`group_properties.$setOnce`	optional	A single operation cannot exceed the published 1,024 group-property request budget. This local bound does not certify the aggregate request budget. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: object. Maximum object properties: 1024.	`vendor.amplitude-group-identify.body.group_properties.$setOnce.invalid`	docs
`group_properties.$add`	optional	A single operation cannot exceed the published 1,024 group-property request budget. This local bound does not certify the aggregate request budget. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: object. Maximum object properties: 1024.	`vendor.amplitude-group-identify.body.group_properties.$add.invalid`	docs
`group_properties.$append`	optional	A single operation cannot exceed the published 1,024 group-property request budget. This local bound does not certify the aggregate request budget. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: object. Maximum object properties: 1024.	`vendor.amplitude-group-identify.body.group_properties.$append.invalid`	docs
`group_properties.$prepend`	optional	A single operation cannot exceed the published 1,024 group-property request budget. This local bound does not certify the aggregate request budget. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: object. Maximum object properties: 1024.	`vendor.amplitude-group-identify.body.group_properties.$prepend.invalid`	docs
`group_properties.$unset`	optional	A single operation cannot exceed the published 1,024 group-property request budget. This local bound does not certify the aggregate request budget. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: object. Maximum object properties: 1024.	`vendor.amplitude-group-identify.body.group_properties.$unset.invalid`	docs
`group_properties.$add.number…`	optional	Every immediate property value in $add is numeric. This applies the documented operation semantics to arbitrary JSON member names, including empty names and line breaks. Body scope: ["[]",""]. Decoded body source: identification. Encoding: json. Native JSON type: number.	`vendor.amplitude-group-identify.body.group_properties.$add.number.invalid`	docs
`method`	required	Use a published Identify transport. Complete HTTP capture contract. Native JSON type: string.	`vendor.amplitude-group-identify.http.method.missing` `vendor.amplitude-group-identify.http.method.empty` `vendor.amplitude-group-identify.http.method.invalid`	docs
`content_type`	required	POST Identify uses form fields rather than a native JSON request body. Complete HTTP capture contract. Applies when {"kind":"value_in","param":"method","values":["POST"]}. Native JSON type: string.	`vendor.amplitude-group-identify.http.content_type.missing` `vendor.amplitude-group-identify.http.content_type.empty` `vendor.amplitude-group-identify.http.content_type.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/amplitude-group-identify

Try this failing payload in the playground. An example with a validation finding.

https://api2.amplitude.com/groupidentify?api_key=project-key&identification=

cargo install pixellint · npm install pixellint