vendor/microsoft-conversions-api · vendor documented

Microsoft CAPI events need eventType, seconds, and a match key

POST JSON to /v1/{tagId}/events. eventType is pageLoad or custom. eventTime is Unix seconds, a 10-digit value. userData needs anonymousId, externalId, em, ph, msclkid, idfa, or gaid. pageLoad needs eventSourceUrl. em is SHA-256 hex. Browser UET on bat.bing.com is vendor/microsoft-uet.

What this pack matches

Hosts: capi.uet.microsoft.com
Paths: /v1/
Vendor docs: learn.microsoft.com/en-us/advertising/guides/uet-conversion-api-integration

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`tag_id`	required	It is the numeric UET tag ID, and it travels in the path as /v1/{tagId}/events. Fix: Put the UET tag ID from Microsoft Advertising in the path as /v1/{tagId}/events.	`vendor.microsoft-conversions-api.param.tag_id.missing` `vendor.microsoft-conversions-api.param.tag_id.empty` `vendor.microsoft-conversions-api.param.tag_id.invalid`	docs
`data`	required	Microsoft documents `data` as the list of events. An empty list sends nothing. Fix: Send at least one event in `data`.	`vendor.microsoft-conversions-api.body.data.missing`	docs
`eventType`	required	It is the event type. Microsoft documents `pageLoad` or `custom`. Fix: Set `eventType` to `pageLoad` or `custom`.	`vendor.microsoft-conversions-api.body.eventType.missing` `vendor.microsoft-conversions-api.body.eventType.empty` `vendor.microsoft-conversions-api.body.eventType.invalid`	docs
`eventTime`	required	It is Unix epoch time in seconds UTC. Microsoft documents seconds, so a 13-digit value is milliseconds and the wrong unit. Fix: Send seconds, a 10-digit Unix timestamp, not milliseconds.	`vendor.microsoft-conversions-api.body.eventTime.missing` `vendor.microsoft-conversions-api.body.eventTime.empty` `vendor.microsoft-conversions-api.body.eventTime.invalid`	docs
`eventId`	recommended	It identifies the event so UET JavaScript and CAPI can deduplicate. Microsoft documents it as required for deduplication. Fix: Set `eventId` to the same value the UET tag sent.	`vendor.microsoft-conversions-api.body.eventId.missing` `vendor.microsoft-conversions-api.body.eventId.empty`	docs
`eventName`	optional	It is the custom conversion action. Microsoft documents it for custom conversion goals.	`vendor.microsoft-conversions-api.body.eventName.empty`	docs
`eventSourceUrl`	optional	It is the page URL. Microsoft documents it as required on `pageLoad` events. Fix: Set `eventSourceUrl` to the absolute page URL.	`vendor.microsoft-conversions-api.body.eventSourceUrl.empty` `vendor.microsoft-conversions-api.body.eventSourceUrl.invalid`	docs
`userData`	required	Microsoft documents `userData` as required, with at least one supported identifier. Fix: Add a `userData` object with at least one of `anonymousId`, `externalId`, `em`, `ph`, `msclkid`, `idfa`, or `gaid`.	`vendor.microsoft-conversions-api.body.userData.missing`	docs
`userData.anonymousId`	optional	It is the guest visitor ID, also used for ID Sync.	`vendor.microsoft-conversions-api.body.userData.anonymousId.empty`	docs
`userData.externalId`	optional	It is an anonymized signed-in user ID.	`vendor.microsoft-conversions-api.body.userData.externalId.empty`	docs
`userData.em`	optional	It is the SHA-256 hex digest of the email. Microsoft documents lowercase hex after trim and lowercase. Fix: Trim, lowercase, SHA-256, and send 64 lowercase hex characters.	`vendor.microsoft-conversions-api.body.userData.em.empty` `vendor.microsoft-conversions-api.body.userData.em.invalid`	docs
`userData.ph`	optional	It is the SHA-256 hex digest of the phone number. Fix: Normalize the phone, SHA-256, and send 64 lowercase hex characters.	`vendor.microsoft-conversions-api.body.userData.ph.empty` `vendor.microsoft-conversions-api.body.userData.ph.invalid`	docs
`userData.msclkid`	optional	It is the Microsoft Click ID. Microsoft documents it as a UUID. Fix: Send the `msclkid` captured from the landing URL as a UUID.	`vendor.microsoft-conversions-api.body.userData.msclkid.empty` `vendor.microsoft-conversions-api.body.userData.msclkid.invalid`	docs
`userData.idfa`	optional	It is the iOS Identifier for Advertisers.	`vendor.microsoft-conversions-api.body.userData.idfa.empty`	docs
`userData.gaid`	optional	It is the Android advertising ID.	`vendor.microsoft-conversions-api.body.userData.gaid.empty`	docs
`customData.currency`	optional	It is the ISO 4217 currency of `customData.value`. Fix: Use a three-letter code such as `USD`.	`vendor.microsoft-conversions-api.body.customData.currency.empty` `vendor.microsoft-conversions-api.body.customData.currency.invalid`	docs
`body.user_needs_an_identifier`	required	`userData` carries none of the identifiers Microsoft requires. Send `anonymousId`, `externalId`, `em`, `ph`, `msclkid`, `idfa`, or `gaid`. Fix: Add at least one supported identifier inside `userData`.	`vendor.microsoft-conversions-api.body.user_needs_an_identifier`	docs
`body.page_load_requires_url`	required	The event is `pageLoad` but carries no `eventSourceUrl`. Microsoft documents the page URL as required on page load events. Fix: Set `eventSourceUrl` to the absolute page URL.	`vendor.microsoft-conversions-api.body.page_load_requires_url`	docs
`body.unhashed_email`	required	`userData.em` carries what looks like a raw email address. Microsoft documents SHA-256 lowercase hex. Fix: Trim, lowercase, hash with SHA-256, and send the 64-character hex digest.	`vendor.microsoft-conversions-api.body.unhashed_email`	docs

Validate a payload

pixellint validate json @payload.json --rulepack vendor/microsoft-conversions-api

Try this failing payload in the playground. Microsoft CAPI eventTime in milliseconds.

{"data":[{"eventType":"custom","eventId":"evt-1","eventTime":1710438591000,"userData":{"anonymousId":"b171a9b06ce011ecafcd1b209be8601b"}}]}

cargo install pixellint · npm install pixellint