vendor/snapchat · vendor documented

Snap writes WEB where Meta writes website

Snap and Meta post the same envelope, down to the field names. A bare payload carries no host, so the packs tell each other apart by action_source. A payload whose action_source is missing or misspelled matches both, and both report it.

Hashed identifiers, unhashed IP and user agent, and event_source_url required when action_source is WEB: same shape of contract as Meta, different enum.

What this pack matches

Hosts: tr.snapchat.com
Paths: …/events…
Vendor docs: developers.snap.com/api/marketing-api/Conversions-API/UsingTheAPI

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`access_token`	required	The events endpoint authenticates with an access token on the request. Fix: Send the Conversions API access token, and keep it out of anything client-side.	`vendor.snapchat.param.access_token.missing` `vendor.snapchat.param.access_token.empty`	docs
`event_name`	required	Snap documents a fixed set of event types, spelled in upper case with underscores. Fix: Use one of the documented event types, such as `PAGE_VIEW` or `PURCHASE`.	`vendor.snapchat.body.event_name.missing` `vendor.snapchat.body.event_name.empty` `vendor.snapchat.body.event_name.invalid`	docs
`event_time`	required	It is the epoch timestamp of the conversion, and Snap only accepts events from the last 7 days. Fix: Send the epoch timestamp of the conversion, not of the moment you forwarded it.	`vendor.snapchat.body.event_time.missing` `vendor.snapchat.body.event_time.empty` `vendor.snapchat.body.event_time.invalid`	docs
`action_source`	required	It says where the event took place, and Snap accepts three values. Fix: Use `WEB`, `OFFLINE`, or `MOBILE_APP`. Snap spells these in upper case, unlike Meta.	`vendor.snapchat.body.action_source.missing` `vendor.snapchat.body.action_source.empty` `vendor.snapchat.body.action_source.invalid`	docs
`event_source_url`	optional	It is the URL of the page the event happened on, and Snap requires it for web events. Fix: Send the full page URL, including the scheme.	`vendor.snapchat.body.event_source_url.empty` `vendor.snapchat.body.event_source_url.invalid`	docs
`user_data`	required	Snap matches the conversion on customer information, and the event needs at least one identifier. Fix: Add a `user_data` object carrying a hashed email, hashed phone, mobile ad id, or IP and user agent pair.	`vendor.snapchat.body.user_data.missing`	docs
`user_data.em`	optional	Email must be normalized and SHA-256 hashed before it is sent. Fix: Trim and lowercase the address, hash it with SHA-256, and send the hex digest.	`vendor.snapchat.body.user_data.em.empty` `vendor.snapchat.body.user_data.em.invalid`	docs
`user_data.em[]`	optional	Every email in the list must be normalized and SHA-256 hashed.	`vendor.snapchat.body.user_data.em[].empty` `vendor.snapchat.body.user_data.em[].invalid`	docs
`user_data.ph`	optional	Phone must be normalized and SHA-256 hashed before it is sent.	`vendor.snapchat.body.user_data.ph.empty` `vendor.snapchat.body.user_data.ph.invalid`	docs
`user_data.ph[]`	optional	Every phone number in the list must be normalized and SHA-256 hashed.	`vendor.snapchat.body.user_data.ph[].empty` `vendor.snapchat.body.user_data.ph[].invalid`	docs
`user_data.fn`	optional	First name must be SHA-256 hashed.	`vendor.snapchat.body.user_data.fn.empty` `vendor.snapchat.body.user_data.fn.invalid`	docs
`user_data.ln`	optional	Last name must be SHA-256 hashed.	`vendor.snapchat.body.user_data.ln.empty` `vendor.snapchat.body.user_data.ln.invalid`	docs
`user_data.ge`	optional	Gender must be SHA-256 hashed.	`vendor.snapchat.body.user_data.ge.empty` `vendor.snapchat.body.user_data.ge.invalid`	docs
`user_data.ct`	optional	City must be SHA-256 hashed.	`vendor.snapchat.body.user_data.ct.empty` `vendor.snapchat.body.user_data.ct.invalid`	docs
`user_data.st`	optional	State must be SHA-256 hashed.	`vendor.snapchat.body.user_data.st.empty` `vendor.snapchat.body.user_data.st.invalid`	docs
`user_data.zp`	optional	Postal code must be SHA-256 hashed.	`vendor.snapchat.body.user_data.zp.empty` `vendor.snapchat.body.user_data.zp.invalid`	docs
`user_data.country`	optional	Country must be SHA-256 hashed.	`vendor.snapchat.body.user_data.country.empty` `vendor.snapchat.body.user_data.country.invalid`	docs
`user_data.client_ip_address`	optional	It is sent unhashed, and it must be the address of the browser rather than of your server.	`vendor.snapchat.body.user_data.client_ip_address.empty`	docs
`user_data.client_user_agent`	optional	It is sent unhashed, and it must be the browser's user agent rather than your HTTP client's.	`vendor.snapchat.body.user_data.client_user_agent.empty`	docs
`body.web_requires_source_url`	required	The event is marked `action_source: WEB` but carries no `event_source_url`, which Snap requires for website events. Fix: Send the URL of the page the event took place on.	`vendor.snapchat.body.web_requires_source_url`	docs
`body.unhashed_email`	required	A field carries what looks like a raw email address. Snap requires customer information to be normalized and SHA-256 hashed. Fix: Trim the address, lowercase it, hash it with SHA-256, and send the hex digest.	`vendor.snapchat.body.unhashed_email`	docs
`body.hashed_plaintext_field`	required	This field looks like a SHA-256 digest, but Snap documents it as one of the parameters that is sent unhashed. Fix: Send the raw value. Hashing it makes the event unmatchable.	`vendor.snapchat.body.hashed_plaintext_field`	docs

Validate a payload

pixellint validate json @payload.json --rulepack vendor/snapchat

Or paste it into the playground. Same engine, in the browser, nothing sent anywhere.

cargo install pixellint · npm install pixellint