Xandr SSPX calls need id and sspdata

Microsoft documents id as the pixel ID and sspdata as the token from the landing page. Put order_id, value, and other before sspdata when you send them. order_id is letters and numbers, at most 36 characters, and other is at most 20. Segment add and remove stay on the browser pixel. Browser conversion pixels stay vendor/xandr.

sspdata is the landing-page token

A /sspx call with no sspdata cannot attribute the conversion to the click.

Rule: vendor.xandr-sspx.param.sspdata.missing

What this pack matches

Hosts: sspx-router.adnxs.com, secure.adnxs.com
Paths: /sspx
Vendor docs: learn.microsoft.com/en-us/xandr/monetize/server-side-conversion-pixels

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`id`	required	It is the Monetize conversion pixel ID. Microsoft documents id on every SSPX call. Fix: Set id to the conversion pixel ID from Monetize.	`vendor.xandr-sspx.param.id.missing` `vendor.xandr-sspx.param.id.empty` `vendor.xandr-sspx.param.id.invalid`	docs
`sspdata`	required	It is the SSP token from the landing page. Microsoft documents sspdata as the populated ${SSP_DATA} value. Fix: Set sspdata to the token the landing page received after the click.	`vendor.xandr-sspx.param.sspdata.missing` `vendor.xandr-sspx.param.sspdata.empty`	docs
`order_id`	optional	It is an order ID or SKU. Microsoft documents the same order_id field as on the browser pixel: letters and numbers, with a 36 character limit. Fix: Set order_id before sspdata to the order or SKU, letters and numbers only, at most 36 characters.	`vendor.xandr-sspx.param.order_id.empty` `vendor.xandr-sspx.param.order_id.invalid`	docs
`value`	optional	It is the dynamic revenue. Microsoft documents a purely numerical value on conversion pixels. Fix: Set value to a number with no currency symbol, such as 10 or 10.50.	`vendor.xandr-sspx.param.value.empty` `vendor.xandr-sspx.param.value.invalid`	docs
`other`	optional	It is extra external data on the conversion. Microsoft documents other on SSPX, with the same letters-and-numbers limit as the browser pixel. Fix: Set other before sspdata to letters and numbers only, at most 20 characters.	`vendor.xandr-sspx.param.other.empty` `vendor.xandr-sspx.param.other.invalid`	docs
`seg`	forbidden	Server-side conversion pixels cannot add a user to segments.	`vendor.xandr-sspx.param.seg.forbidden`	docs
`remove`	forbidden	Server-side conversion pixels cannot remove a user from segments.	`vendor.xandr-sspx.param.remove.forbidden`	docs
`token_not_last`	required	Microsoft requires sspdata to be the final parameter in a server-side conversion URL.	`vendor.xandr-sspx.token_not_last`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/xandr-sspx

Try this failing payload in the playground. Xandr SSPX missing sspdata.

https://sspx-router.adnxs.com/sspx?id=59633

cargo install pixellint · npm install pixellint