Tapad Tapestry requests check the archived SDK profile.
Legacy advisory profile of Tapad's archived Android Tapestry SDK for exact /tapestry/1. Checks documented numeric controls, empty operation flags and JSON string-map/list construction. Client-specific required fields, identifiers, current service behavior and other transports remain unvalidated.
What this pack matches
Rules
Codes are stable. A finding in CI, MCP, or the playground lands on the same id.
| Field | Required | What it checks | Rule ids | Source |
|---|---|---|---|---|
ta_sadd_data |
optional | Archived SDK addUniqueData serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_remove_data |
optional | Archived SDK removeData serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_set_data |
optional | Archived SDK setData serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_add_data |
optional | Archived SDK addData serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_user_ids |
optional | Archived SDK userIds serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_analytics |
optional | Archived SDK analytics serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_typed_did |
optional | Archived SDK typedDid serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_clear_data |
optional | Archived SDK clearData serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_add_audiences |
optional | Archived SDK addAudiences serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_remove_audiences |
optional | Archived SDK removeAudiences serializes this value as UTF-8 form-encoded JSON. Only the published container and member string types are checked; keys and values remain open. Presence diagnostic severity: warning. | docs | |
ta_strength |
optional | Archived SDK documents an integer from 1 through 5. This is a legacy SDK advisory, not a current server rejection condition. Presence diagnostic severity: warning. Minimum numeric value: 1. Maximum numeric value: 5. | vendor.tapad-tapestry.param.ta_strength.emptyvendor.tapad-tapestry.param.ta_strength.invalid |
docs |
ta_depth |
optional | Archived SDK documents an integer from 0 through 2. This is a legacy SDK advisory, not a current server rejection condition. Presence diagnostic severity: warning. Minimum numeric value: 0. Maximum numeric value: 2. | vendor.tapad-tapestry.param.ta_depth.emptyvendor.tapad-tapestry.param.ta_depth.invalid |
docs |
ta_get |
optional | Archived SDK serializes this operation switch as an empty query value. A populated value differs from that producer; no missing switch is required on other clients. Presence diagnostic severity: warning. | vendor.tapad-tapestry.param.ta_get.emptyvendor.tapad-tapestry.param.ta_get.invalid |
docs |
ta_list_devices |
optional | Archived SDK serializes this operation switch as an empty query value. A populated value differs from that producer; no missing switch is required on other clients. Presence diagnostic severity: warning. | vendor.tapad-tapestry.param.ta_list_devices.emptyvendor.tapad-tapestry.param.ta_list_devices.invalid |
docs |
ta_partner_id |
optional | Published SDK passes this scalar through. No identifier grammar, requiredness across other clients, or external account validation is inferred. | docs | |
ta_partner_did |
optional | Published SDK passes this scalar through. No identifier grammar, requiredness across other clients, or external account validation is inferred. | docs | |
ta_platform |
optional | Published SDK passes this scalar through. No identifier grammar, requiredness across other clients, or external account validation is inferred. | docs | |
root |
optional | The archived SDK serializes its map as a JSON object. Empty objects are allowed. Decoded body source: ta_sadd_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object. | vendor.tapad-tapestry.body.root.invalid |
docs |
* |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_sadd_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.*.invalid |
docs |
root |
optional | The archived SDK serializes its map as a JSON object. Empty objects are allowed. Decoded body source: ta_remove_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object. | vendor.tapad-tapestry.body.root.invalid |
docs |
* |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_remove_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.*.invalid |
docs |
root |
optional | The archived SDK serializes its map as a JSON object. Empty objects are allowed. Decoded body source: ta_set_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object. | vendor.tapad-tapestry.body.root.invalid |
docs |
* |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_set_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.*.invalid |
docs |
root |
optional | The archived SDK serializes its map as a JSON object. Empty objects are allowed. Decoded body source: ta_add_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object. | vendor.tapad-tapestry.body.root.invalid |
docs |
* |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_add_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.*.invalid |
docs |
root |
optional | The archived SDK serializes its map as a JSON object. Empty objects are allowed. Decoded body source: ta_user_ids. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object. | vendor.tapad-tapestry.body.root.invalid |
docs |
* |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_user_ids. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.*.invalid |
docs |
root |
optional | The archived SDK serializes its map as a JSON object. Empty objects are allowed. Decoded body source: ta_analytics. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object. | vendor.tapad-tapestry.body.root.invalid |
docs |
* |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_analytics. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.*.invalid |
docs |
isNewSession |
optional | analytics(Boolean) serializes Boolean.toString as a JSON string. Unknown custom keys are not forbidden. Decoded body source: ta_analytics. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. | vendor.tapad-tapestry.body.isNewSession.emptyvendor.tapad-tapestry.body.isNewSession.invalid |
docs |
root |
optional | The archived SDK serializes its map as a JSON object. Empty objects are allowed. Decoded body source: ta_typed_did. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object. | vendor.tapad-tapestry.body.root.invalid |
docs |
* |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_typed_did. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.*.invalid |
docs |
root |
optional | The SDK serializes a Java list as a JSON array, permitting empty lists. Decoded body source: ta_clear_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: array. | vendor.tapad-tapestry.body.root.invalid |
docs |
[] |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_clear_data. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.[].invalid |
docs |
root |
optional | The SDK serializes a Java list as a JSON array, permitting empty lists. Decoded body source: ta_add_audiences. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: array. | vendor.tapad-tapestry.body.root.invalid |
docs |
[] |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_add_audiences. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.[].invalid |
docs |
root |
optional | The SDK serializes a Java list as a JSON array, permitting empty lists. Decoded body source: ta_remove_audiences. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: array. | vendor.tapad-tapestry.body.root.invalid |
docs |
[] |
optional | The archived API takes String arguments. Strings, including empty values, are checked. Null remains accepted because no nullability restriction or uniform JSON-library null behavior is published. Decoded body source: ta_remove_audiences. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string or null. | vendor.tapad-tapestry.body.[].invalid |
docs |
method |
required | Pinned SDK sendSynchronously invokes performGet. Advisory only; no Android-only header requirement is imposed on other clients. Complete HTTP capture contract. Presence diagnostic severity: warning. | vendor.tapad-tapestry.http.method.missingvendor.tapad-tapestry.http.method.emptyvendor.tapad-tapestry.http.method.invalid |
docs |
Validate a payload
pixellint validate url "$ARTIFACT" --rulepack vendor/tapad-tapestryTry this failing payload in the playground. An example with a validation finding.
https://tapestry.tapad.com/tapestry/1?ta_get=1
cargo install pixellint
·
npm install pixellint