Clipflip callbacks check generated VAST fields.

Advisory completeness checks for callbacks returned by Clipflip's public VAST tester sample. Nonempty creative and event path slots and the generated v query field are checked. Issued identifiers, accepted events, ord semantics, server rejection policy and delivery remain outside this profile. The pinned VPAID SDK overlay-click POST branch adds separately guarded JSON-envelope advisories; ordinary GET events retain their existing scope.

What this pack matches

Hosts: app.clipflip.video
Paths: Full path expression: ^/api/vast/tracking/[^/]*/[^/]*$
Vendor docs: www.clipflip.video/vast-tester/

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`creative_path`	required	The public sample emits a nonempty opaque creative path slot. This warning checks template completeness and does not establish an issued-ID format or server rejection rule. Presence diagnostic severity: warning. Fix: Preserve the generated creative path component from the original callback.	`vendor.clipflip-vast-tracking.param.creative_path.missing` `vendor.clipflip-vast-tracking.param.creative_path.empty`	docs
`event_path`	required	The public sample emits a nonempty event path component. Event values remain open; no closed event list or VAST mapping is imposed. Presence diagnostic severity: warning. Fix: Preserve the generated event path component from the original callback.	`vendor.clipflip-vast-tracking.param.event_path.missing` `vendor.clipflip-vast-tracking.param.event_path.empty`	docs
`v`	recommended	All reviewed impression, event, click and error callbacks retain a nonempty v query field. Presence is observed producer-template completeness, not a vendor mandatory-field or delivery guarantee. No version enumeration is inferred. Presence diagnostic severity: warning. Fix: Preserve the original generated v field.	`vendor.clipflip-vast-tracking.param.v.missing` `vendor.clipflip-vast-tracking.param.v.empty`	docs
`method`	optional	Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`path`	optional	Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`content_type`	recommended	Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"value_in","param":"method","values":["POST"]},{"kind":"value_pattern","param":"path","pattern":"^/api/vast/tracking/[^/]+/overlay-click$"}]}. Presence diagnostic severity: warning. Value diagnostic severity: warning.	`vendor.clipflip-vast-tracking.http.content_type.missing` `vendor.clipflip-vast-tracking.http.content_type.empty` `vendor.clipflip-vast-tracking.http.content_type.invalid`	docs
`body`	recommended	Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"value_in","param":"method","values":["POST"]},{"kind":"value_pattern","param":"path","pattern":"^/api/vast/tracking/[^/]+/overlay-click$"}]}. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: object.	`vendor.clipflip-vast-tracking.http.body.missing` `vendor.clipflip-vast-tracking.http.body.invalid`	docs
`body.data`	recommended	Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"value_in","param":"method","values":["POST"]},{"kind":"value_pattern","param":"path","pattern":"^/api/vast/tracking/[^/]+/overlay-click$"}]}. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: object.	`vendor.clipflip-vast-tracking.http.body.data.missing` `vendor.clipflip-vast-tracking.http.body.data.invalid`	docs
`body.data.overlayId`	recommended	The overlay branch runs for a truthy overlay identifier. The value stays opaque; no issued-ID or alphabet is imposed. Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"value_in","param":"method","values":["POST"]},{"kind":"value_pattern","param":"path","pattern":"^/api/vast/tracking/[^/]+/overlay-click$"}]}. Presence diagnostic severity: warning. Value diagnostic severity: warning.	`vendor.clipflip-vast-tracking.http.body.data.overlayId.missing`	docs
`body.data.source`	recommended	The pinned overlay producer emits VAST. This is a source-profile advisory, not a universal collector enum. Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"value_in","param":"method","values":["POST"]},{"kind":"value_pattern","param":"path","pattern":"^/api/vast/tracking/[^/]+/overlay-click$"}]}. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string.	`vendor.clipflip-vast-tracking.http.body.data.source.missing` `vendor.clipflip-vast-tracking.http.body.data.source.empty` `vendor.clipflip-vast-tracking.http.body.data.source.invalid`	docs
`body.data.eventType`	optional	The first POST serializes the caller event before later a.includes can throw. Null, number, object, empty and omitted values are possible emitted boundaries. Native types and event vocabulary remain open. Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"value_in","param":"method","values":["POST"]},{"kind":"value_pattern","param":"path","pattern":"^/api/vast/tracking/[^/]+/overlay-click$"}]}. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.data.progress`	recommended	The producer rounds a progress ratio without clamping. Negative and greater-than-100 values remain valid. Nonfinite arithmetic serializes as null. Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"value_in","param":"method","values":["POST"]},{"kind":"value_pattern","param":"path","pattern":"^/api/vast/tracking/[^/]+/overlay-click$"}]}. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: number or null.	`vendor.clipflip-vast-tracking.http.body.data.progress.missing` `vendor.clipflip-vast-tracking.http.body.data.progress.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/clipflip-vast-tracking

Try this failing payload in the playground. An example with a validation finding.

https://app.clipflip.video/api/vast/tracking/x/?v=x

cargo install pixellint · npm install pixellint