PubMatic VPAID notices check the published error sender.

Pinned PMAdMgr.js error-builder advice on exact st.pubmatic.com/track, selected only with operId=7 and a vadsId key. Other operations, older notices without that marker and adjacent services remain uncovered.

What this pack matches

Hosts: st.pubmatic.com
Paths: /track
Vendor docs: vpaid.pubmatic.com/ads/video/PMAdMgr.js

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`operId`	recommended	The inspected error URL builder emits operation 7. The matching marker scopes this producer profile and does not define other operation meanings. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.operId.missing` `vendor.pubmatic-vpaid-error.param.operId.empty` `vendor.pubmatic-vpaid-error.param.operId.invalid`	docs
`p`	recommended	Publisher reference is appended unconditionally. Zero, blank, sentinel and opaque values remain accepted; no account or ID-format law is inferred. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.p.missing`	docs
`s`	recommended	Site reference is appended unconditionally. This producer advisory checks key presence without an inferred ID grammar. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.s.missing`	docs
`a`	recommended	Ad reference is appended unconditionally. Native zero and blank inputs remain valid producer outputs. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.a.missing`	docs
`ts`	recommended	Math.round(new Date().valueOf()/1000) produces a signed decimal seconds value. Preserve zero and negative values without a freshness, digit-width or account-clock claim. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.ts.missing` `vendor.pubmatic-vpaid-error.param.ts.empty` `vendor.pubmatic-vpaid-error.param.ts.invalid`	docs
`wa`	recommended	The builder appends its caller-provided network reference. This remains opaque, including zero and numeric strings. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.wa.missing`	docs
`vadsId`	recommended	The current builder always appends adServingId, whose native default is the string -1 and which may be blank. Presence is the current source-profile discriminator; older notices without it remain unclaimed. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.vadsId.missing`	docs
`wc`	recommended	A campaign reference is appended when the caller network loosely equals 243. Presence advice is restricted to the canonical wire spelling 243; equivalent numeric strings remain accepted without exhaustive JavaScript coercion claims. Applies when {"kind":"all_values_in","params":["wa"],"values":["243"]}. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.wc.missing`	docs
`e`	optional	A truthy explicit event argument selects this carrier. Event values stay open, including string 0 and future event codes. Presence diagnostic severity: warning.		docs
`er`	optional	Without a truthy explicit event, the builder emits the ERRORCODE macro. Literal vendor error codes and future encodings remain open. Presence diagnostic severity: warning.		docs
`crId`	optional	Truthy creative reference copied from configuration. Numeric zero is omitted while string 0 is retained; no grammar or requiredness is inferred. Presence diagnostic severity: warning.		docs
`ucrid`	optional	Truthy universal creative reference copied without a local scalar contract. Presence diagnostic severity: warning.		docs
`impid`	optional	Truthy impression reference copied without an ID-format or equality rule. Presence diagnostic severity: warning.		docs
`advertiser_id`	optional	Truthy advertiser reference copied without inferred numeric or account requirements. Presence diagnostic severity: warning.		docs
`ecpm`	optional	Truthy configuration value copied directly. Numeric zero may be omitted while string 0 is retained; no numeric format or currency law is inferred. Presence diagnostic severity: warning.		docs
`pmc`	optional	The publisher-consent value is omitted for native numeric -1, while string -1 is retained. This is not an IAB consent alias and no enum or permission policy is inferred. Presence diagnostic severity: warning.		docs
`isAk`	optional	The inspected builder appends only native numeric 0,1 or 2, which serialize to these exact strings. Absence remains allowed for other source configuration types. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.param.isAk.empty` `vendor.pubmatic-vpaid-error.param.isAk.invalid`	docs
`vc`	optional	The inspected image dispatcher appends its video-client marker 2. Keep optional and open because a pre-dispatch template omits it and other clients remain external context. Presence diagnostic severity: warning.		docs
`error_carrier_missing`	recommended	The inspected error builder emits an e key or an er key. Preserve the carrier from the originating sender; no event/error value or exclusivity law is inferred.	`vendor.pubmatic-vpaid-error.error_carrier_missing`	docs
`https_source_profile`	recommended	The inspected PMAdMgr error builder constructs an HTTPS tracker URL. This is a producer-profile advisory.	`vendor.pubmatic-vpaid-error.https_source_profile`	docs
`method`	required	The inspected dispatcher creates an img element and sets its src, producing a GET capture. No body, content-type or header requirement is inferred. Complete HTTP capture contract. Presence diagnostic severity: warning.	`vendor.pubmatic-vpaid-error.http.method.missing` `vendor.pubmatic-vpaid-error.http.method.empty` `vendor.pubmatic-vpaid-error.http.method.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/pubmatic-vpaid-error

Try this failing payload in the playground. An example with a validation finding.

https://st.pubmatic.com/track?operId=7&p=0&s=0&a=0&ts=1793000000&wa=0&vadsId=-1&isAk=0

cargo install pixellint · npm install pixellint