ID5 CTV S2S needs partner, ts, appid, ver, ip, and ua

ID5 documents the CTV fetch as POST JSON to /gc/v1. appid is the store ID. Cookie sync GIFs are not this pack. Mobile in-app /ga/v1 is vendor/id5.

appid is the store ID, not bundle

A /gc/v1 body with no appid is not the published CTV fetch. Mobile in-app uses bundle on /ga/v1.

Rule: vendor.id5-ctv.body.appid.missing

What this pack matches

Hosts: api.id5-sync.com
Paths: /gc/v1
Vendor docs: wiki.id5.io/docs/ctv-integration

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`root`	optional	ID5 accepts a JSON object as its request body. Native JSON type: object.	`vendor.id5-ctv.body.root.invalid`	docs
`partner`	required	It is the ID5 Partner Number. ID5 documents partner as required on /gc/v1. Native JSON type: integer. Minimum numeric value: -2147483648. Maximum numeric value: 2147483647. Fix: Set partner to the Partner Number ID5 issued. Use 173 only while testing.	`vendor.id5-ctv.body.partner.missing` `vendor.id5-ctv.body.partner.invalid`	docs
`ts`	required	It is the request timestamp. ID5 documents ts as required, as an ISO-8601 string with a time zone offset. Native JSON type: string. Fix: Set ts to an ISO-8601 timestamp with offset, such as 2013-02-01T12:52:34+09:00.	`vendor.id5-ctv.body.ts.missing` `vendor.id5-ctv.body.ts.empty` `vendor.id5-ctv.body.ts.invalid`	docs
`appid`	required	It is the store ID of the app. ID5 documents appid as required on /gc/v1. Native JSON type: string. Fix: Set appid to the Apple App Store, Google Play, or equivalent store ID.	`vendor.id5-ctv.body.appid.missing` `vendor.id5-ctv.body.appid.empty` `vendor.id5-ctv.body.appid.invalid`	docs
`ver`	required	It is the application version. ID5 documents ver as required. Fix: Set ver to the app version string.	`vendor.id5-ctv.body.ver.missing` `vendor.id5-ctv.body.ver.empty`	docs
`ip`	required	It is the IPv4 address closest to the device. ID5 documents ip as required. Native JSON type: string. Fix: Send the device-facing IPv4 address, unhashed.	`vendor.id5-ctv.body.ip.missing` `vendor.id5-ctv.body.ip.empty` `vendor.id5-ctv.body.ip.invalid`	docs
`ua`	required	It is the device default-browser user agent. ID5 documents ua as required. Native JSON type: string. Fix: Send the raw user agent string, unhashed.	`vendor.id5-ctv.body.ua.missing` `vendor.id5-ctv.body.ua.empty` `vendor.id5-ctv.body.ua.invalid`	docs
`hem`	optional	It is a SHA-256 hash of the cleansed email. ID5 documents hem as sha256 when present. Native JSON type: string. Fix: Normalize and SHA-256 hash the identifier, then send its 64-character hexadecimal digest.	`vendor.id5-ctv.body.hem.empty` `vendor.id5-ctv.body.hem.invalid`	docs
`phone`	optional	It is a SHA-256 hash of the cleansed phone number. Native JSON type: string. Fix: Normalize and SHA-256 hash the identifier, then send its 64-character hexadecimal digest.	`vendor.id5-ctv.body.phone.empty` `vendor.id5-ctv.body.phone.invalid`	docs
`provider`	optional	ID5 documents provider as an optional string request field. Native JSON type: string.	`vendor.id5-ctv.body.provider.empty` `vendor.id5-ctv.body.provider.invalid`	docs
`signature`	optional	ID5 documents signature as an optional string request field. Native JSON type: string.	`vendor.id5-ctv.body.signature.empty` `vendor.id5-ctv.body.signature.invalid`	docs
`gdpr_consent`	optional	ID5 documents gdpr_consent as an optional string request field. Native JSON type: string.	`vendor.id5-ctv.body.gdpr_consent.empty` `vendor.id5-ctv.body.gdpr_consent.invalid`	docs
`gpp_string`	optional	ID5 documents gpp_string as an optional string request field. Native JSON type: string.	`vendor.id5-ctv.body.gpp_string.empty` `vendor.id5-ctv.body.gpp_string.invalid`	docs
`region`	optional	ID5 accepts ISO 3166-2 subdivision codes, or a two-letter state code for the USA. Native JSON type: string.	`vendor.id5-ctv.body.region.empty` `vendor.id5-ctv.body.region.invalid`	docs
`city`	optional	ID5 names the UN/LOCODE format, two country letters followed by three letters or digits 2 through 9. Native JSON type: string.	`vendor.id5-ctv.body.city.empty` `vendor.id5-ctv.body.city.invalid`	docs
`accept_language`	optional	ID5 requires compatibility with the browser Accept-Language header. RFC 9110 and RFC 4647 define basic language ranges and optional quality weights from 0 to 1 with at most three fractional digits. Evidence: formal standard. Native JSON type: string.	`vendor.id5-ctv.body.accept_language.empty` `vendor.id5-ctv.body.accept_language.invalid`	docs
`gdpr`	optional	ID5 documents 1 when GDPR applies and 0 otherwise. Native JSON type: integer. Minimum numeric value: 0. Maximum numeric value: 1.	`vendor.id5-ctv.body.gdpr.invalid`	docs
`allowed_vendors`	optional	ID5 documents allowed_vendors as an array of vendor identifier strings. Native JSON type: array.	`vendor.id5-ctv.body.allowed_vendors.invalid`	docs
`allowed_vendors[]`	optional	ID5 accepts ID5-prefixed partner identifiers or numeric IAB vendor IDs. Native JSON type: string.	`vendor.id5-ctv.body.allowed_vendors[].empty` `vendor.id5-ctv.body.allowed_vendors[].invalid`	docs
`us_privacy`	optional	ID5 accepts the IAB US Privacy String. Native JSON type: string.	`vendor.id5-ctv.body.us_privacy.empty` `vendor.id5-ctv.body.us_privacy.invalid`	docs
`gpp_sid`	optional	ID5 allows one GPP section ID or at most two comma-separated section IDs. Native JSON type: string.	`vendor.id5-ctv.body.gpp_sid.empty` `vendor.id5-ctv.body.gpp_sid.invalid`	docs
`idfv`	optional	ID5 documents the Apple vendor identifier in UUID format. Native JSON type: string.	`vendor.id5-ctv.body.idfv.empty` `vendor.id5-ctv.body.idfv.invalid`	docs
`ipv6`	optional	ID5 documents ipv6 as the device IPv6 address. Native JSON type: string.	`vendor.id5-ctv.body.ipv6.empty` `vendor.id5-ctv.body.ipv6.invalid`	docs
`country`	optional	ID5 documents country as an ISO 3166-1 alpha-2 code. Native JSON type: string.	`vendor.id5-ctv.body.country.empty` `vendor.id5-ctv.body.country.invalid`	docs
`segments`	optional	ID5 documents segments as an array of objects. Native JSON type: array.	`vendor.id5-ctv.body.segments.invalid`	docs
`segments[]`	optional	Every ID5 segment entry is an object. Native JSON type: object.	`vendor.id5-ctv.body.segments[].invalid`	docs
`hardware_code`	optional	ID5 documents hardware_code as an optional string request field. Native JSON type: string.	`vendor.id5-ctv.body.hardware_code.empty` `vendor.id5-ctv.body.hardware_code.invalid`	docs
`ottid`	deprecated	ID5 marks ottid deprecated in favor of the identifiers array. Native JSON type: string.	`vendor.id5-ctv.body.ottid.deprecated` `vendor.id5-ctv.body.ottid.empty` `vendor.id5-ctv.body.ottid.invalid`	docs
`ctvid`	deprecated	ID5 marks ctvid deprecated in favor of the identifiers array. Native JSON type: string.	`vendor.id5-ctv.body.ctvid.deprecated` `vendor.id5-ctv.body.ctvid.empty` `vendor.id5-ctv.body.ctvid.invalid`	docs
`ctvid_type`	deprecated	ID5 marks ctvid_type deprecated in favor of the identifiers array. Native JSON type: string.	`vendor.id5-ctv.body.ctvid_type.deprecated` `vendor.id5-ctv.body.ctvid_type.empty` `vendor.id5-ctv.body.ctvid_type.invalid`	docs
`puid`	deprecated	ID5 marks puid deprecated in favor of the identifiers array. Native JSON type: string.	`vendor.id5-ctv.body.puid.deprecated` `vendor.id5-ctv.body.puid.empty` `vendor.id5-ctv.body.puid.invalid`	docs
`identifiers`	optional	ID5 documents CTV advertising identifiers as an array. Native JSON type: array.	`vendor.id5-ctv.body.identifiers.invalid`	docs
`identifiers[]`	optional	Each CTV identifier is an object containing id and type. Native JSON type: object.	`vendor.id5-ctv.body.identifiers[].invalid`	docs
`body.unhashed_email`	required	A field carries what looks like a raw email address. ID5 documents hem as a SHA-256 digest of a cleansed email. Fix: Cleanse the email, hash it with SHA-256, and send it as hem.	`vendor.id5-ctv.body.unhashed_email`	docs
`body.us_region_format`	required	ID5 specifies a two-letter state code for USA regions.	`vendor.id5-ctv.body.us_region_format`	docs
`body.non_us_region_iso_format`	required	ID5 permits the two-letter state abbreviation only for the United States. Other supplied countries require an ISO 3166-2 region code.	`vendor.id5-ctv.body.non_us_region_iso_format`	docs
`destination`	required	Every segment needs its destination IAB vendor identifier. Body scope: segments[]. Native JSON type: string.	`vendor.id5-ctv.body.destination.missing` `vendor.id5-ctv.body.destination.empty` `vendor.id5-ctv.body.destination.invalid`	docs
`ids`	required	Every segment needs an array of string segment identifiers. Body scope: segments[]. Native JSON type: array.	`vendor.id5-ctv.body.ids.missing` `vendor.id5-ctv.body.ids.invalid`	docs
`ids[]`	optional	Segment identifiers are strings. Body scope: segments[]. Native JSON type: string.	`vendor.id5-ctv.body.ids[].empty` `vendor.id5-ctv.body.ids[].invalid`	docs
`id`	required	ID5 requires the identifier value. UUID is usual, but other identifier formats are supported. Body scope: identifiers[]. Native JSON type: string.	`vendor.id5-ctv.body.id.missing` `vendor.id5-ctv.body.id.empty` `vendor.id5-ctv.body.id.invalid`	docs
`type`	required	ID5 requires the identifier type. Values outside its named types are accepted as UNKNOWN. Body scope: identifiers[]. Native JSON type: string.	`vendor.id5-ctv.body.type.missing` `vendor.id5-ctv.body.type.empty` `vendor.id5-ctv.body.type.invalid`	docs
`body.identifier_lowercase`	recommended	ID5 recommends lowercasing the CTV identifier value. Body scope: identifiers[].	`vendor.id5-ctv.body.identifier_lowercase`	docs
`method`	required	The published endpoint accepts an HTTP POST request. Complete HTTP capture contract.	`vendor.id5-ctv.http.method.missing` `vendor.id5-ctv.http.method.empty` `vendor.id5-ctv.http.method.invalid`	docs
`content_type`	required	The request Content-Type is application/json; MIME parameters do not change its media type. Complete HTTP capture contract.	`vendor.id5-ctv.http.content_type.missing` `vendor.id5-ctv.http.content_type.empty` `vendor.id5-ctv.http.content_type.invalid`	docs
`body_encoding`	required	The published request carries a JSON entity. Once application/json is known, an absent body is invalid. Opaque compressed captures and unresolved MIME macros are left unverified. Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"not","condition":{"kind":"value_in","param":"body_encoding","values":["unsupported"]}},{"kind":"any","conditions":[{"kind":"value_in","param":"body_encoding","values":["none"]},{"kind":"value_in","param":"content_type","values":["application/json"]}]}]}.	`vendor.id5-ctv.http.body_encoding.missing` `vendor.id5-ctv.http.body_encoding.empty` `vendor.id5-ctv.http.body_encoding.invalid`	docs

Validate a payload

pixellint validate json @payload.json --rulepack vendor/id5-ctv

Try this failing payload in the playground. ID5 CTV S2S missing partner.

{"ts":"2023-09-19T12:32:34+02:00","appid":"ABCDE12345.com.example.foo","ver":"1.0","ip":"4.5.6.7","ua":"Mozilla/5.0"}

cargo install pixellint · npm install pixellint