Yahoo browser pixels use separate image and purchase collectors.

The pinned ytc.js runtime sends image requests to /sp.pl and purchase JSON to /collect. These collectors differ from the documented /spp.pl noscript image.

Envelope and hash-array checks are advisory producer conventions. Forwarded eventData and other identities remain open. Account configuration and delivery require external context.

What this pack matches

Hosts: sp.analytics.yahoo.com
Paths: /sp.pl, /collect
Vendor docs: s.yimg.com/wi/ytc.js

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`transport`	optional	Collector route from the path.		docs
`a`	recommended	The JavaScript image collector supplies a configured identifier. Applies when {"kind":"value_in","param":"transport","values":["sp.pl"]}. Presence diagnostic severity: warning.	`vendor.yahoo-browser.param.a.missing` `vendor.yahoo-browser.param.a.empty`	docs
`.yp`	recommended	The JavaScript image collector supplies a configured identifier. Applies when {"kind":"value_in","param":"transport","values":["sp.pl"]}. Presence diagnostic severity: warning.	`vendor.yahoo-browser.param..yp.missing` `vendor.yahoo-browser.param..yp.empty`	docs
`b`	optional	Optional page metadata from the producer.		docs
`c`	optional	Optional page metadata from the producer.		docs
`f`	optional	Optional page metadata from the producer. Presence diagnostic severity: warning.	`vendor.yahoo-browser.param.f.empty` `vendor.yahoo-browser.param.f.invalid`	docs
`e`	optional	Optional page metadata from the producer. Presence diagnostic severity: warning.	`vendor.yahoo-browser.param.e.empty` `vendor.yahoo-browser.param.e.invalid`	docs
`enc`	optional	Optional page metadata from the producer.		docs
`yv`	optional	Optional page metadata from the producer.		docs
`isIframe`	optional	The producer marks iframe pixels with 1. Presence diagnostic severity: warning.	`vendor.yahoo-browser.param.isIframe.empty` `vendor.yahoo-browser.param.isIframe.invalid`	docs
`he`	optional	Enhanced matching is a SHA-256 hexadecimal digest. Presence diagnostic severity: warning.	`vendor.yahoo-browser.param.he.empty` `vendor.yahoo-browser.param.he.invalid`	docs
`hph`	optional	Enhanced matching is a SHA-256 hexadecimal digest. Presence diagnostic severity: warning.	`vendor.yahoo-browser.param.hph.empty` `vendor.yahoo-browser.param.hph.invalid`	docs
`auid`	optional	Enhanced matching is a SHA-256 hexadecimal digest. Presence diagnostic severity: warning.	`vendor.yahoo-browser.param.auid.empty` `vendor.yahoo-browser.param.auid.invalid`	docs
`root`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.yahoo-browser.body.root.invalid`	docs
`eventEpoch`	recommended	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: integer.	`vendor.yahoo-browser.body.eventEpoch.missing` `vendor.yahoo-browser.body.eventEpoch.invalid`	docs
`eventSource`	recommended	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.yahoo-browser.body.eventSource.missing` `vendor.yahoo-browser.body.eventSource.empty` `vendor.yahoo-browser.body.eventSource.invalid`	docs
`eventType`	recommended	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.yahoo-browser.body.eventType.missing` `vendor.yahoo-browser.body.eventType.empty` `vendor.yahoo-browser.body.eventType.invalid`	docs
`pageUrl`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.yahoo-browser.body.pageUrl.empty` `vendor.yahoo-browser.body.pageUrl.invalid`	docs
`pixelId`	optional	The SDK forwards the caller pixel identity.		docs
`privacyData`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.yahoo-browser.body.privacyData.invalid`	docs
`userData`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.yahoo-browser.body.userData.invalid`	docs
`userData.ids`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.yahoo-browser.body.userData.ids.invalid`	docs
`userData.ids.EMAIL`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: array.	`vendor.yahoo-browser.body.userData.ids.EMAIL.invalid`	docs
`userData.ids.PHONE`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: array.	`vendor.yahoo-browser.body.userData.ids.PHONE.invalid`	docs
`userData.ids.EMAIL[]`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.yahoo-browser.body.userData.ids.EMAIL[].empty` `vendor.yahoo-browser.body.userData.ids.EMAIL[].invalid`	docs
`userData.ids.PHONE[]`	optional	The published contract specifies this field type. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.yahoo-browser.body.userData.ids.PHONE[].empty` `vendor.yahoo-browser.body.userData.ids.PHONE[].invalid`	docs
`path`	optional	Collector route. Complete HTTP capture contract.		docs
`method`	recommended	GET images and POST purchase JSON. Complete HTTP capture contract. Applies when {"kind":"value_in","param":"path","values":["/sp.pl"]}. Presence diagnostic severity: warning.	`vendor.yahoo-browser.http.method.missing` `vendor.yahoo-browser.http.method.empty` `vendor.yahoo-browser.http.method.invalid`	docs
`purchase_method`	recommended	Purchase JSON uses POST. Complete HTTP capture contract. Applies when {"kind":"value_in","param":"path","values":["/collect"]}. Presence diagnostic severity: warning.	`vendor.yahoo-browser.http.purchase_method.missing` `vendor.yahoo-browser.http.purchase_method.empty` `vendor.yahoo-browser.http.purchase_method.invalid`	docs
`body`	recommended	A complete purchase capture carries a JSON object. Complete HTTP capture contract. Applies when {"kind":"value_in","param":"path","values":["/collect"]}. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.yahoo-browser.http.body.missing` `vendor.yahoo-browser.http.body.invalid`	docs

Validate a payload

pixellint validate request @request.json --rulepack vendor/yahoo-browser

Try this failing payload in the playground. A Yahoo purchase with an unhashed email array.

{"url": "https://sp.analytics.yahoo.com/collect", "method": "POST", "headers": {"Content-Type": "application/json"}, "body": "{\"eventEpoch\": 1792560000, \"eventSource\": \"web\", \"eventType\": \"purchase\", \"privacyData\": {}, \"pixelId\": 12345, \"eventData\": [\"opaque\", null], \"userData\": {\"ids\": {\"EMAIL\": [\"raw@example.test\"], \"PHONE\": [\"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\"], \"OTHER\": \"open\"}}}"}

cargo install pixellint · npm install pixellint