FullStory page requests check the default SDK envelope.

Warning-only shape checks for the pinned browser SDK POST /rec/page on its default recorder host. The actual transport is text/plain containing JSON. Scrubbed and omitted privacy fields, empty key hashes and optional identity fields are preserved. Bundle encoding, custom hosts, session validity and receiver rejection policy remain external.

What this pack matches

Hosts: rs.fullstory.com
Paths: /rec/page
Vendor docs: edge.fullstory.com/s/fs.js

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`method`	recommended	Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.	`vendor.fullstory-page.http.method.missing` `vendor.fullstory-page.http.method.empty` `vendor.fullstory-page.http.method.invalid`	docs
`content_type`	recommended	Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.	`vendor.fullstory-page.http.content_type.missing` `vendor.fullstory-page.http.content_type.empty` `vendor.fullstory-page.http.content_type.invalid`	docs
`body`	recommended	Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: object.	`vendor.fullstory-page.http.body.missing` `vendor.fullstory-page.http.body.invalid`	docs
`body.OrgId`	recommended	Initialization requires a configured organization string. Only producer completeness is checked, without issued-ID grammar. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string.	`vendor.fullstory-page.http.body.OrgId.missing` `vendor.fullstory-page.http.body.OrgId.invalid`	docs
`body.CompiledVersion`	recommended	The producer emits its build string; no fixed hash or version value is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string.	`vendor.fullstory-page.http.body.CompiledVersion.missing` `vendor.fullstory-page.http.body.CompiledVersion.invalid`	docs
`body.CompiledTimestamp`	recommended	The producer emits its numeric build timestamp. No runtime clock or age bounds are inferred. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: number.	`vendor.fullstory-page.http.body.CompiledTimestamp.missing` `vendor.fullstory-page.http.body.CompiledTimestamp.invalid`	docs
`body.SessionKeyHash`	recommended	The source initializes this field to an empty string. Empty is valid and no hash grammar is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string.	`vendor.fullstory-page.http.body.SessionKeyHash.missing` `vendor.fullstory-page.http.body.SessionKeyHash.invalid`	docs
`body.PageKeyHash`	recommended	The source initializes this field to an empty string. Empty is valid and no hash grammar is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string.	`vendor.fullstory-page.http.body.PageKeyHash.missing` `vendor.fullstory-page.http.body.PageKeyHash.invalid`	docs
`body.Url`	optional	Privacy scrubbing can omit or empty this field. No URL scheme, nonempty value or receiver requirement is inferred. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string or null.	`vendor.fullstory-page.http.body.Url.invalid`	docs
`body.Base`	optional	Privacy scrubbing can omit or empty this field. No URL scheme, nonempty value or receiver requirement is inferred. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string or null.	`vendor.fullstory-page.http.body.Base.invalid`	docs
`body.Referrer`	optional	Privacy scrubbing can omit or empty this field. No URL scheme, nonempty value or receiver requirement is inferred. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string or null.	`vendor.fullstory-page.http.body.Referrer.invalid`	docs
`body.Width`	optional	Optional source numeric metadata. No sign, size, integer or clock bounds are imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: number or null.	`vendor.fullstory-page.http.body.Width.invalid`	docs
`body.Height`	optional	Optional source numeric metadata. No sign, size, integer or clock bounds are imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: number or null.	`vendor.fullstory-page.http.body.Height.invalid`	docs
`body.ScreenWidth`	optional	Optional source numeric metadata. No sign, size, integer or clock bounds are imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: number or null.	`vendor.fullstory-page.http.body.ScreenWidth.invalid`	docs
`body.ScreenHeight`	optional	Optional source numeric metadata. No sign, size, integer or clock bounds are imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: number or null.	`vendor.fullstory-page.http.body.ScreenHeight.invalid`	docs
`body.PreviewMode`	optional	The source omits false preview mode; true is emitted when enabled. Absence remains valid. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: boolean.	`vendor.fullstory-page.http.body.PreviewMode.invalid`	docs
`body.UserId`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.SessionId`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.PageId`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.SessionUid`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.SnippetVersion`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.AppId`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.TabId`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.Preroll`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.Doctype`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs
`body.ReplayFlags`	optional	Source runtime value is opaque and may be omitted. No identifier alphabet or native type is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning.		docs

Validate a payload

pixellint validate request @request.json --rulepack vendor/fullstory-page

Try this failing payload in the playground. An example with a validation finding.

{"url":"https://rs.fullstory.com/rec/page","method":"POST","headers":{"Content-Type":"text/plain"}}

cargo install pixellint · npm install pixellint