Customer.io Track events check submitted payloads.

Customer.io Track v1 events endpoint and locally checkable payload contracts.

What this pack matches

Hosts: track.customer.io, track-eu.customer.io
Paths: /api/v1/events, Full path expression: /api/v1/customers/[^/]+/events
Vendor docs: docs.customer.io/integrations/api/track/tag/track-events/track/

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`root`	optional	Native JSON type: object.	`vendor.customerio-track.body.root.invalid`	docs
`name`	required	Native JSON type: string. Maximum decoded UTF-8 bytes: 100.	`vendor.customerio-track.body.name.missing` `vendor.customerio-track.body.name.invalid`	docs
`data`	optional	Native JSON type: object. Maximum compact JSON bytes: 100000.	`vendor.customerio-track.body.data.invalid`	docs
`id`	optional	Native JSON type: string.	`vendor.customerio-track.body.id.empty` `vendor.customerio-track.body.id.invalid`	docs
`timestamp`	optional	Native JSON type: integer.	`vendor.customerio-track.body.timestamp.invalid`	docs
`type`	optional	Unknown non-page/screen values default to event; no closed enum is imposed. Native JSON type: string.	`vendor.customerio-track.body.type.invalid`	docs
`anonymous_id`	optional	Native JSON type: string.	`vendor.customerio-track.body.anonymous_id.invalid`	docs
`data.from_address`	optional	Native JSON type: string.	`vendor.customerio-track.body.data.from_address.invalid`	docs
`data.recipient`	optional	Native JSON type: string.	`vendor.customerio-track.body.data.recipient.invalid`	docs
`data.reply_to`	optional	Native JSON type: string.	`vendor.customerio-track.body.data.reply_to.invalid`	docs
`method`	required	Complete HTTP capture contract. Native JSON type: string.	`vendor.customerio-track.http.method.missing` `vendor.customerio-track.http.method.empty` `vendor.customerio-track.http.method.invalid`	docs
`content_type`	required	Complete HTTP capture contract. Native JSON type: string.	`vendor.customerio-track.http.content_type.missing` `vendor.customerio-track.http.content_type.empty` `vendor.customerio-track.http.content_type.invalid`	docs
`body`	required	Complete HTTP capture contract.	`vendor.customerio-track.http.body.missing`	docs
`authorization_scheme`	required	Complete HTTP capture contract. Native JSON type: string.	`vendor.customerio-track.http.authorization_scheme.missing` `vendor.customerio-track.http.authorization_scheme.empty` `vendor.customerio-track.http.authorization_scheme.invalid`	docs
`basic_auth.username`	required	Complete HTTP capture contract. Native JSON type: string.	`vendor.customerio-track.http.basic_auth.username.missing` `vendor.customerio-track.http.basic_auth.username.invalid`	docs
`basic_auth.password`	required	Complete HTTP capture contract. Native JSON type: string.	`vendor.customerio-track.http.basic_auth.password.missing` `vendor.customerio-track.http.basic_auth.password.invalid`	docs
`headers.authorization`	required	HTTP Basic credentials use the standard Base64 alphabet and padding. Complete HTTP capture contract. Native JSON type: string.	`vendor.customerio-track.http.headers.authorization.missing` `vendor.customerio-track.http.headers.authorization.empty` `vendor.customerio-track.http.headers.authorization.invalid`	docs
`basic_auth.has_colon`	required	These APIs require a key and secret separated by a colon; colonless legacy keys are not this profile. Complete HTTP capture contract. Native JSON type: boolean.	`vendor.customerio-track.http.basic_auth.has_colon.missing` `vendor.customerio-track.http.basic_auth.has_colon.empty` `vendor.customerio-track.http.basic_auth.has_colon.invalid`	docs

Validate a payload

pixellint validate request @request.json --rulepack vendor/customerio-track

Try this failing payload in the playground. An example with a validation finding.

{
  "url": "https://track.customer.io/api/v1/customers/synthetic/events",
  "method": "POST",
  "headers": {
    "Content-Type": "application/json"
  },
  "body": "{\"name\":\"purchase\",\"data\":{\"price\":23.45,\"product\":\"socks\"}}"
}

cargo install pixellint · npm install pixellint