Heap identify needs app_id, user_id, and identity

Not /api/track. Identify migrates an anonymous SDK user_id onto a known identity. user_id is digits. Heap drops a second identity on the same user_id. Track stays vendor/heap-track.

user_id is the SDK id, not the email

Heap documents user_id as the numeric string from the SDK. identity is the email or login.

Rule: vendor.heap-identify.body.user_id.invalid

What this pack matches

Hosts: heapanalytics.com, c.eu.heap-api.com
Paths: /api/v1/identify
Vendor docs: developers.heap.io/reference/identify-1

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`app_id`	required	It is the Heap environment ID. Heap documents it as required on identify. Native JSON type: string. Fix: Set app_id to the environment ID from Heap Projects.	`vendor.heap-identify.body.app_id.missing` `vendor.heap-identify.body.app_id.empty` `vendor.heap-identify.body.app_id.invalid`	docs
`user_id`	required	It is the anonymous user_id from the Heap SDK. Heap documents a numeric string between 0 and 2^53-1. Native JSON type: string. Minimum numeric value: 0. Maximum numeric value: 9007199254740991. Fix: Send the Heap SDK user_id as digits, not the login email.	`vendor.heap-identify.body.user_id.missing` `vendor.heap-identify.body.user_id.empty` `vendor.heap-identify.body.user_id.invalid`	docs
`identity`	required	It is the known identity, such as an email. Heap documents it as required and case-sensitive, limited to 255 characters. Native JSON type: string. Maximum decoded characters: 255. Fix: Send a unique identity. Heap drops a second identity on the same user_id.	`vendor.heap-identify.body.identity.missing` `vendor.heap-identify.body.identity.empty` `vendor.heap-identify.body.identity.invalid`	docs
`timestamp`	optional	ISO 8601 timestamp. The source does not mandate a timezone. Native JSON type: string. Fix: Send an ISO 8601 timestamp, such as 2017-03-10T22:21:56+00:00.	`vendor.heap-identify.body.timestamp.empty` `vendor.heap-identify.body.timestamp.invalid`	docs
`root`	optional	The vendor documents `` in the request contract. Native JSON type: object.	`vendor.heap-identify.body.root.invalid`	docs
`method`	required	This published ingestion operation uses HTTP POST. Complete HTTP capture contract. Native JSON type: string.	`vendor.heap-identify.http.method.missing` `vendor.heap-identify.http.method.empty` `vendor.heap-identify.http.method.invalid`	docs
`content_type`	recommended	Use a published request media type. Complete HTTP capture contract. Presence diagnostic severity: warning. Value diagnostic severity: warning. Native JSON type: string.	`vendor.heap-identify.http.content_type.missing` `vendor.heap-identify.http.content_type.empty` `vendor.heap-identify.http.content_type.invalid`	docs
`body`	required	The request body is a JSON object. Complete HTTP capture contract. Native JSON type: object.	`vendor.heap-identify.http.body.missing` `vendor.heap-identify.http.body.invalid`	docs

Validate a payload

pixellint validate json @payload.json --rulepack vendor/heap-identify

Try this failing payload in the playground. Heap identify missing identity.

{"app_id":"11","user_id":"1847839267195673"}

cargo install pixellint · npm install pixellint