Sourcepoint choice requests check the documented GDPR template.

Warning-only captured HTTP advice for the exact legacy GDPR choice route published in the CMP callback article. The current SDK uses a different route. Choice IDs and identifiers stay opaque; callback outputs, body schemas, consent state and receiver acceptance are outside this partial profile.

What this pack matches

Hosts: cdn.privacy-mgmt.com
Paths: Full path expression: /wrapper/v2/messages/choice/gdpr/[^/]+
Vendor docs: docs.sourcepoint.com/hc/en-us/articles/4405397484307-Event-callbacks-CMP

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`requestUUID`	recommended	The documented wire template includes the request UUID query slot. This presence advice does not impose UUID syntax, nonempty values or account validity. Presence diagnostic severity: warning.	`vendor.sourcepoint-gdpr-choice.param.requestUUID.missing`	docs
`env`	recommended	The exact wire example describes prod and stage as the campaign environment enum. Presence advice follows that example; empty slots, account eligibility and generic configuration env values are not receiver contracts. Presence diagnostic severity: warning. Evidence: vendor documented.	`vendor.sourcepoint-gdpr-choice.param.env.missing` `vendor.sourcepoint-gdpr-choice.param.env.empty` `vendor.sourcepoint-gdpr-choice.param.env.invalid`	docs
`hasCsp`	optional	The article shows hasCsp=true without defining its meaning. The generic SDK helper can preserve arbitrary existing text. No Boolean, presence or always-true requirement is imposed. Presence diagnostic severity: warning.		docs
`method`	recommended	The CMP article explicitly identifies this exact wire call as POST. The advisory does not define a complete receiver method contract. Complete HTTP capture contract. Presence diagnostic severity: warning. Evidence: vendor documented.	`vendor.sourcepoint-gdpr-choice.http.method.missing` `vendor.sourcepoint-gdpr-choice.http.method.empty` `vendor.sourcepoint-gdpr-choice.http.method.invalid`	docs

Validate a payload

pixellint validate request @request.json --rulepack vendor/sourcepoint-gdpr-choice

Try this failing payload in the playground. An example with a validation finding.

{
  "url": "https://cdn.privacy-mgmt.com/wrapper/v2/messages/choice/gdpr/11?hasCsp=true&env=prod",
  "method": "POST",
  "headers": {}
}

cargo install pixellint · npm install pixellint