vendor/meta · vendor documented

Meta Pixel requests need a Pixel ID

The browser pixel is a GET to facebook.com/tr. Without id, Meta has nothing to attribute. ev is required; an unrecognized value warns because custom events are legal, which is how Purchse (a typo) ships as a custom event.

Advanced Matching still has to be hashed. A raw email on the query string is a privacy incident and a matching miss.

id is the numeric Pixel ID

It comes from Events Manager. A missing or empty id is an error. The pack does not invent a format beyond numeric.

Rule: vendor.meta.param.id.missing

Unhashed email on the query string

Normalize, SHA-256, send the hex. The same rule exists on the Conversions API pack for the JSON body.

Rule: vendor.meta.pii.unhashed_email

What this pack matches

Hosts: facebook.com
Paths: /tr
Vendor docs: developers.facebook.com/docs/meta-pixel/get-started

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`id`	required	It is the numeric Pixel ID from Events Manager. Fix: Set `id` to the numeric Pixel ID shown in Events Manager.	`vendor.meta.param.id.missing` `vendor.meta.param.id.empty` `vendor.meta.param.id.invalid`	docs
`ev`	required	Custom event names are allowed, so check that this is a deliberate custom event and not a misspelled standard one. Fix: Use a standard event name, or confirm the custom event is registered in Events Manager.	`vendor.meta.param.ev.missing` `vendor.meta.param.ev.empty` `vendor.meta.param.ev.invalid`	docs
`noscript`	optional	The base code sends `noscript=1` from the img fallback.	`vendor.meta.param.noscript.empty` `vendor.meta.param.noscript.invalid`	docs
`dpo`	optional	Limited Data Use is enabled by sending `dpo=LDU`.	`vendor.meta.param.dpo.empty` `vendor.meta.param.dpo.invalid`	docs
`dpoco`	optional	It is the country for Limited Data Use: `1` for the United States, `0` to let Meta geolocate.	`vendor.meta.param.dpoco.empty` `vendor.meta.param.dpoco.invalid`	docs
`dpost`	optional	It is the state code for Limited Data Use, or `0` to let Meta geolocate.	`vendor.meta.param.dpost.empty` `vendor.meta.param.dpost.invalid`	docs
`cd[value]`	optional	It is the monetary value of the conversion. Meta documents `value` as required for Purchase events. Fix: Send the value as a number, without a currency symbol.		docs
`cd[currency]`	optional	It is the ISO 4217 currency code of the conversion value. Meta documents `currency` as required for Purchase events. Fix: Send the three-letter code, such as `USD`.	`vendor.meta.param.cd[currency].empty` `vendor.meta.param.cd[currency].invalid`	docs
`pii.unhashed_email`	required	A parameter carries what looks like a raw email address. Meta requires customer information to be normalized and SHA-256 hashed before it is sent. Fix: Normalize the value, hash it with SHA-256, and send the hex digest instead of the plain address.	`vendor.meta.pii.unhashed_email`	docs
`ldu.country_without_state`	required	Limited Data Use sends a country without a state. Meta requires both together, otherwise it geolocates the user instead of honoring the values you sent. Fix: Send `dpost` alongside `dpoco`, or drop both and let Meta geolocate.	`vendor.meta.ldu.country_without_state`	docs
`purchase_requires_value_and_currency`	required	A `Purchase` event is missing its value or currency. Meta documents both as required for Purchase, and without them the conversion reports no revenue. Fix: Pass `value` and `currency` in the event data: fbq('track', 'Purchase', { value: 12.34, currency: 'USD' }).	`vendor.meta.purchase_requires_value_and_currency`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/meta

Or paste it into the playground. Same engine, in the browser, nothing sent anywhere.

cargo install pixellint · npm install pixellint