Clarity collector envelopes carry timing and event tuples.

The Clarity SDK posts JSON envelopes to its /collect endpoint. This profile checks the envelope tuple and the time and event-code prefix of each event row.

Future payload tokens and event codes remain open. The SDK custom gzip transport stays explicitly unvalidated when its wire capture cannot be decoded. These checks do not prove masking or consent.

What this pack matches

Hosts: clarity.ms
Paths: /collect
Vendor docs: raw.githubusercontent.com/microsoft/clarity/master/packages/clarity-js/src/data/upload.ts

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`root`	optional	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.microsoft-clarity-collect.body.root.invalid`	docs
`e`	recommended	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: array. Minimum array items: 8.	`vendor.microsoft-clarity-collect.body.e.missing` `vendor.microsoft-clarity-collect.body.e.invalid`	docs
`a`	recommended	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: array.	`vendor.microsoft-clarity-collect.body.a.missing` `vendor.microsoft-clarity-collect.body.a.invalid`	docs
`p`	optional	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: array.	`vendor.microsoft-clarity-collect.body.p.invalid`	docs
`e[0]`	recommended	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.microsoft-clarity-collect.body.e[0].missing` `vendor.microsoft-clarity-collect.body.e[0].invalid`	docs
`e[4]`	recommended	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.microsoft-clarity-collect.body.e[4].missing` `vendor.microsoft-clarity-collect.body.e[4].invalid`	docs
`e[5]`	optional	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.microsoft-clarity-collect.body.e[5].invalid`	docs
`e[6]`	optional	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.microsoft-clarity-collect.body.e[6].invalid`	docs
`e[11]`	optional	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.microsoft-clarity-collect.body.e[11].empty` `vendor.microsoft-clarity-collect.body.e[11].invalid`	docs
`e[1]`	recommended	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 1.	`vendor.microsoft-clarity-collect.body.e[1].missing` `vendor.microsoft-clarity-collect.body.e[1].invalid`	docs
`e[2]`	recommended	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 0.	`vendor.microsoft-clarity-collect.body.e[2].missing` `vendor.microsoft-clarity-collect.body.e[2].invalid`	docs
`e[3]`	recommended	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 0.	`vendor.microsoft-clarity-collect.body.e[3].missing` `vendor.microsoft-clarity-collect.body.e[3].invalid`	docs
`e[7]`	recommended	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 1.	`vendor.microsoft-clarity-collect.body.e[7].missing` `vendor.microsoft-clarity-collect.body.e[7].invalid`	docs
`e[8]`	optional	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: integer.	`vendor.microsoft-clarity-collect.body.e[8].empty` `vendor.microsoft-clarity-collect.body.e[8].invalid`	docs
`e[9]`	optional	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: integer.	`vendor.microsoft-clarity-collect.body.e[9].empty` `vendor.microsoft-clarity-collect.body.e[9].invalid`	docs
`e[10]`	optional	The pinned producer emits this native JSON type. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 0.	`vendor.microsoft-clarity-collect.body.e[10].invalid`	docs
`root`	optional	The pinned producer emits this native JSON type. Body scope: a[]. Presence diagnostic severity: warning. Native JSON type: array. Minimum array items: 2.	`vendor.microsoft-clarity-collect.body.root.invalid`	docs
`[0]`	recommended	The pinned producer emits this native JSON type. Body scope: a[]. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 0.	`vendor.microsoft-clarity-collect.body.[0].missing` `vendor.microsoft-clarity-collect.body.[0].invalid`	docs
`[1]`	recommended	The pinned producer emits this native JSON type. Body scope: a[]. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 0.	`vendor.microsoft-clarity-collect.body.[1].missing` `vendor.microsoft-clarity-collect.body.[1].invalid`	docs
`root`	optional	The pinned producer emits this native JSON type. Body scope: p[]. Presence diagnostic severity: warning. Native JSON type: array. Minimum array items: 2.	`vendor.microsoft-clarity-collect.body.root.invalid`	docs
`[0]`	recommended	The pinned producer emits this native JSON type. Body scope: p[]. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 0.	`vendor.microsoft-clarity-collect.body.[0].missing` `vendor.microsoft-clarity-collect.body.[0].invalid`	docs
`[1]`	recommended	The pinned producer emits this native JSON type. Body scope: p[]. Presence diagnostic severity: warning. Native JSON type: integer. Minimum numeric value: 0.	`vendor.microsoft-clarity-collect.body.[1].missing` `vendor.microsoft-clarity-collect.body.[1].invalid`	docs
`method`	recommended	The source uses these transport methods. Complete HTTP capture contract. Presence diagnostic severity: warning.	`vendor.microsoft-clarity-collect.http.method.missing` `vendor.microsoft-clarity-collect.http.method.empty` `vendor.microsoft-clarity-collect.http.method.invalid`	docs
`body`	recommended	A complete capture needs the JSON request body. Complete HTTP capture contract. Applies when {"kind":"value_in","param":"method","values":["POST"]}. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.microsoft-clarity-collect.http.body.missing` `vendor.microsoft-clarity-collect.http.body.invalid`	docs

Validate a payload

pixellint validate request @request.json --rulepack vendor/microsoft-clarity-collect

Try this failing payload in the playground. A Clarity envelope with a nonbinary upload flag.

{"url": "https://m.clarity.ms/collect", "method": "POST", "headers": {"Content-Type": "application/json"}, "body": "{\"e\": [\"0.8.49\", 1, 0, 100, \"project\", \"user\", \"session\", 1, 2, 0, 0, \"https://example.test/\"], \"a\": []}"}

cargo install pixellint · npm install pixellint