vendor/appsflyer · vendor documented

AppsFlyer S2S in-app events

Posted to api3.appsflyer.com/inappevent. The JSON body is the contract. The pack flags what AppsFlyer documents as required on that endpoint.

What this pack matches

Hosts: api3.appsflyer.com
Paths: …/inappevent/…
Vendor docs: dev.appsflyer.com/hc/reference/s2s-events-api3-overview

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`app_id`	required	It is the app identifier from the AppsFlyer dashboard, and it travels in the path. iOS apps must be prefixed with `id`. Fix: Put the dashboard app ID in the path after `/inappevent/`. Prefix iOS IDs with `id`.	`vendor.appsflyer.param.app_id.missing` `vendor.appsflyer.param.app_id.empty`	docs
`ios_app_id_unprefixed`	recommended	This app ID is digits only. AppsFlyer documents that iOS IDs must be prefixed with `id`; without it the call still returns 200 and the event is not recorded. Fix: Prefix the iOS app ID with `id`, such as `id123456789`.	`vendor.appsflyer.ios_app_id_unprefixed`	docs
`appsflyer_id`	required	It is the AppsFlyer device identifier generated on first launch, and the endpoint requires it. Fix: Send the `appsflyer_id` the SDK generated for this install.	`vendor.appsflyer.body.appsflyer_id.missing` `vendor.appsflyer.body.appsflyer_id.empty`	docs
`eventName`	required	It is the in-app event name, and the endpoint requires it. Fix: Set `eventName` to the event the marketer expects, such as `af_purchase`.	`vendor.appsflyer.body.eventName.missing` `vendor.appsflyer.body.eventName.empty`	docs
`eventTime`	optional	AppsFlyer documents UTC as `yyyy-mm-dd hh:mm:ss.sss`. An epoch number is stamped as the arrival time instead. Fix: Send UTC as `2019-05-15 12:17:01.123`, with a space, not `T`.	`vendor.appsflyer.body.eventTime.empty` `vendor.appsflyer.body.eventTime.invalid`	docs
`eventCurrency`	optional	It is an ISO 4217 currency code. Fix: Use the three-letter code, such as `USD`.	`vendor.appsflyer.body.eventCurrency.empty` `vendor.appsflyer.body.eventCurrency.invalid`	docs
`email_hashed`	optional	Email must be trimmed, lowercased, and SHA-256 hashed before it is sent. Fix: Trim and lowercase the address, hash it with SHA-256, and send the hex digest.	`vendor.appsflyer.body.email_hashed.empty` `vendor.appsflyer.body.email_hashed.invalid`	docs
`phone_number_hashed`	optional	Phone must be normalized and SHA-256 hashed before it is sent. Fix: Strip symbols and leading zeros, keep the country code, hash with SHA-256, and send the hex digest.	`vendor.appsflyer.body.phone_number_hashed.empty` `vendor.appsflyer.body.phone_number_hashed.invalid`	docs
`phone_number_e164_hashed`	optional	An E.164 phone number must be SHA-256 hashed before it is sent. Fix: Normalize to E.164, hash with SHA-256, and send the hex digest.	`vendor.appsflyer.body.phone_number_e164_hashed.empty` `vendor.appsflyer.body.phone_number_e164_hashed.invalid`	docs
`first_name_hashed`	optional	First name must be lowercased and SHA-256 hashed before it is sent. Fix: Lowercase the name, hash it with SHA-256, and send the hex digest.	`vendor.appsflyer.body.first_name_hashed.empty` `vendor.appsflyer.body.first_name_hashed.invalid`	docs
`last_name_hashed`	optional	Last name must be lowercased and SHA-256 hashed before it is sent. Fix: Lowercase the name, hash it with SHA-256, and send the hex digest.	`vendor.appsflyer.body.last_name_hashed.empty` `vendor.appsflyer.body.last_name_hashed.invalid`	docs
`ip`	optional	It is the device IP address during the event, sent unhashed. Fix: Send the device IP, not a SHA-256 digest.	`vendor.appsflyer.body.ip.empty`	docs
`body.unhashed_email`	required	A field carries what looks like a raw email address. AppsFlyer documents email as `email_hashed`, SHA-256 hashed on the client side. Fix: Trim the address, lowercase it, hash it with SHA-256, and send it as `email_hashed`.	`vendor.appsflyer.body.unhashed_email`	docs
`body.hashed_plaintext_field`	required	`ip` looks like a SHA-256 digest, but AppsFlyer documents it as the device IP address, unhashed. Fix: Send the raw IP address. Hashing it makes geo matching fail.	`vendor.appsflyer.body.hashed_plaintext_field`	docs

Validate a payload

pixellint validate json @payload.json --rulepack vendor/appsflyer

Or paste it into the playground. Same engine, in the browser, nothing sent anywhere.

cargo install pixellint · npm install pixellint