Yahoo conversions check captured requests and credentials.

Standard Yahoo CAPI /v1/events/{pixelId} captures gain transport and OAuth advice. Missing pixel slots retain diagnostics. Neighboring paths and Product CAPI are outside this contract.

POST and captured JSON transport are checked. OAuth carrier checks remain advisory because the public guide retains historical enforcement differences. Token validity requires account context.

What this pack matches

Hosts: batch.datax.yahoo.com
Paths: /v1/events, Full path expression: /v1/events/[^/]*
Vendor docs: help.yahooinc.com/dsp-api/docs/standard-yahoo-conversion-api

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`pixel_id`	required	It is the Yahoo DSP pixel ID. Yahoo documents the batch endpoint as /v1/events/{pixelId}. Fix: Put the DSP pixel ID in the path, such as /v1/events/10157549. Do not reuse a live Dot pixel ID.	`vendor.yahoo-conversions-api.param.pixel_id.missing` `vendor.yahoo-conversions-api.param.pixel_id.empty` `vendor.yahoo-conversions-api.param.pixel_id.invalid`	docs
`root`	optional	The Standard CAPI request body is an array of event objects. Native JSON type: array. Minimum array items: 1.	`vendor.yahoo-conversions-api.body.root.invalid`	docs
`[]`	optional	The vendor documents the JSON shape or value type of this field. Native JSON type: object.	`vendor.yahoo-conversions-api.body.[].invalid`	docs
`eventTs`	required	It is the event time in seconds or milliseconds. Yahoo documents eventTs as required. Body scope: []. Native JSON type: integer. Fix: Set eventTs to a Unix timestamp in seconds or milliseconds.	`vendor.yahoo-conversions-api.body.eventTs.missing` `vendor.yahoo-conversions-api.body.eventTs.empty` `vendor.yahoo-conversions-api.body.eventTs.invalid`	docs
`eventName`	required	It is the event action name. Yahoo documents eventName as required. Body scope: []. Native JSON type: string. Fix: Set eventName to the action the DSP rule matches, such as addToCart or Purchase.	`vendor.yahoo-conversions-api.body.eventName.missing` `vendor.yahoo-conversions-api.body.eventName.empty` `vendor.yahoo-conversions-api.body.eventName.invalid`	docs
`actionSource`	required	It is the digital or physical source of the event. Yahoo documents actionSource as required. Body scope: []. Native JSON type: string. Fix: Set actionSource to a source such as web, app, phone, email, online, or physical_store.	`vendor.yahoo-conversions-api.body.actionSource.missing` `vendor.yahoo-conversions-api.body.actionSource.empty` `vendor.yahoo-conversions-api.body.actionSource.invalid`	docs
`eventId`	optional	It is the advertiser's event id. Yahoo documents it as optional, and duplicate ids are dropped. Body scope: []. Native JSON type: string. Fix: Send a unique `eventId` per conversion, or drop the empty pair.	`vendor.yahoo-conversions-api.body.eventId.empty` `vendor.yahoo-conversions-api.body.eventId.invalid`	docs
`actionSourceUrl`	optional	It is the page URL where the conversion happened. Yahoo documents it as optional, and null for some sources such as phone or physical_store. Body scope: []. Native JSON type: string or null. Fix: Send an absolute URL in `actionSourceUrl`, or omit it.	`vendor.yahoo-conversions-api.body.actionSourceUrl.empty` `vendor.yahoo-conversions-api.body.actionSourceUrl.invalid`	docs
`country`	optional	It is the country of the event. Yahoo documents two characters, such as `US`. Body scope: []. Fix: Send a two-letter country code such as `US`.	`vendor.yahoo-conversions-api.body.country.empty` `vendor.yahoo-conversions-api.body.country.invalid`	docs
`userData`	required	It is the wrapper for match keys. Yahoo documents userData as required, with at least one ID or clickData. Body scope: []. Native JSON type: object. Fix: Send a userData object with hashed email, phone, device ID, or pxid, or send clickData.	`vendor.yahoo-conversions-api.body.userData.missing` `vendor.yahoo-conversions-api.body.userData.invalid`	docs
`userData.email`	optional	Email must be lowercased and SHA-256 hashed. Yahoo documents userData.email as a list of hashes. Body scope: []. Native JSON type: array. Minimum array items: 1. Fix: Lowercase the email, hash it with SHA-256, and send 64 lowercase hex characters.	`vendor.yahoo-conversions-api.body.userData.email.invalid`	docs
`userData.email[]`	optional	Every email in the list must be SHA-256 hashed. Body scope: []. Native JSON type: string. Fix: Lowercase each email, hash it with SHA-256, and send the hex digests.	`vendor.yahoo-conversions-api.body.userData.email[].empty` `vendor.yahoo-conversions-api.body.userData.email[].invalid`	docs
`userData.phone`	optional	Phone numbers must be SHA-256 hashed. Yahoo documents userData.phone as a list of hashes. Body scope: []. Native JSON type: array. Minimum array items: 1. Fix: Hash the phone number with SHA-256 and send 64 lowercase hex characters.	`vendor.yahoo-conversions-api.body.userData.phone.invalid`	docs
`userData.phone[]`	optional	Every phone number in the list must be SHA-256 hashed. Body scope: []. Native JSON type: string. Fix: Hash each phone number with SHA-256 and send the hex digests.	`vendor.yahoo-conversions-api.body.userData.phone[].empty` `vendor.yahoo-conversions-api.body.userData.phone[].invalid`	docs
`userData.gpsaid`	optional	It is a list of Android advertising IDs. Body scope: []. Native JSON type: array. Minimum array items: 1.	`vendor.yahoo-conversions-api.body.userData.gpsaid.invalid`	docs
`userData.idfa`	optional	It is a list of Apple advertising IDs. Body scope: []. Native JSON type: array. Minimum array items: 1.	`vendor.yahoo-conversions-api.body.userData.idfa.invalid`	docs
`userData.pxid`	optional	It is a partner match ID. Yahoo documents the form `pxIdSrcId:pxIdValue`. Body scope: []. Native JSON type: array. Minimum array items: 1. Fix: Send `userData.pxid` as `sourceId:value`, such as `999:XY50038zETeXJBOYNTRn7Z3T6VSkxDF5ZpRz3wvPEVmt1ZXHo`.	`vendor.yahoo-conversions-api.body.userData.pxid.invalid`	docs
`userData.pxid[]`	optional	Every partner match ID in the list must be `sourceId:value`. Body scope: []. Fix: Send each `pxid` as `sourceId:value`.	`vendor.yahoo-conversions-api.body.userData.pxid[].empty` `vendor.yahoo-conversions-api.body.userData.pxid[].invalid`	docs
`userData.ip_address`	optional	It is the device IP address. Yahoo documents it as unhashed. Body scope: []. Native JSON type: string. Fix: Send the raw IP in `userData.ip_address`, not a digest.	`vendor.yahoo-conversions-api.body.userData.ip_address.empty` `vendor.yahoo-conversions-api.body.userData.ip_address.invalid`	docs
`userData.userAgent`	optional	It is the browser user agent. Yahoo documents it as the HTTP header, unhashed. Body scope: []. Native JSON type: string. Fix: Send the raw user agent in `userData.userAgent`, not a digest.	`vendor.yahoo-conversions-api.body.userData.userAgent.empty` `vendor.yahoo-conversions-api.body.userData.userAgent.invalid`	docs
`eventData.price`	optional	It is the conversion value. Yahoo documents a number, assumed USD when no currency is sent. Body scope: []. Native JSON type: number. Fix: Send `eventData.price` as a number such as `12.99`.	`vendor.yahoo-conversions-api.body.eventData.price.invalid`	docs
`clickData.vmcid`	optional	It is the Yahoo Click ID. Yahoo documents clickData as a match key when user IDs are not available. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.clickData.vmcid.empty` `vendor.yahoo-conversions-api.body.clickData.vmcid.invalid`	docs
`clickData.tblci`	optional	It is the Taboola Click ID. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.clickData.tblci.empty` `vendor.yahoo-conversions-api.body.clickData.tblci.invalid`	docs
`root`	optional	Each event is a JSON object, rather than a scalar or list. Body scope: []. Native JSON type: object.	`vendor.yahoo-conversions-api.body.root.invalid`	docs
`eventData`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: object.	`vendor.yahoo-conversions-api.body.eventData.invalid`	docs
`clickData`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: object.	`vendor.yahoo-conversions-api.body.clickData.invalid`	docs
`privacy`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: object.	`vendor.yahoo-conversions-api.body.privacy.invalid`	docs
`userData.gpsaid[]`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.userData.gpsaid[].empty` `vendor.yahoo-conversions-api.body.userData.gpsaid[].invalid`	docs
`userData.idfa[]`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.userData.idfa[].empty` `vendor.yahoo-conversions-api.body.userData.idfa[].invalid`	docs
`region`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.region.invalid`	docs
`privacy.privacy_type`	required	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.privacy.privacy_type.missing` `vendor.yahoo-conversions-api.body.privacy.privacy_type.empty` `vendor.yahoo-conversions-api.body.privacy.privacy_type.invalid`	docs
`privacy.consent_string`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.privacy.consent_string.empty` `vendor.yahoo-conversions-api.body.privacy.consent_string.invalid`	docs
`privacy.gpp_sid`	optional	GPP requires one or two active section IDs. Yahoo rejects more than two. Section correspondence and Yahoo-supported section policy are separate checks. Body scope: []. Native JSON type: array. Minimum array items: 1. Maximum array items: 2.	`vendor.yahoo-conversions-api.body.privacy.gpp_sid.invalid`	docs
`privacy.gpp_sid[]`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: integer.	`vendor.yahoo-conversions-api.body.privacy.gpp_sid[].invalid`	docs
`eventData.products`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: array.	`vendor.yahoo-conversions-api.body.eventData.products.invalid`	docs
`eventData.products[]`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: object.	`vendor.yahoo-conversions-api.body.eventData.products[].invalid`	docs
`eventData.products[].category`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.eventData.products[].category.invalid`	docs
`eventData.products[].subCategory`	optional	The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.eventData.products[].subCategory.invalid`	docs
`eventData.customKeyValues`	optional	The published vendor reference specifies this field. Body scope: []. Native JSON type: object.	`vendor.yahoo-conversions-api.body.eventData.customKeyValues.invalid`	docs
`eventData.customKeyValues.*`	optional	The published vendor reference specifies this field. Body scope: []. Native JSON type: string.	`vendor.yahoo-conversions-api.body.eventData.customKeyValues.*.invalid`	docs
`body.unhashed_email`	required	A field carries what looks like a raw email address. Yahoo documents userData.email as SHA-256 hashed, lowercased values. Body scope: []. Fix: Lowercase the email, hash it with SHA-256, and send the hex digest in userData.email.	`vendor.yahoo-conversions-api.body.unhashed_email`	docs
`body.user_needs_an_identifier`	required	The event has no match key. Yahoo documents at least one of hashed email, phone, gpsaid, idfa, pxid, or clickData. Body scope: []. Fix: Send hashed userData.email, phone, gpsaid, idfa, or pxid, or send clickData.vmcid or clickData.tblci.	`vendor.yahoo-conversions-api.body.user_needs_an_identifier`	docs
`body.hashed_plaintext_field`	required	This field looks like a SHA-256 digest, but Yahoo documents `userData.ip_address` and `userData.userAgent` as unhashed. Body scope: []. Fix: Send the raw IP address or user agent. Hashing it makes the event unmatchable.	`vendor.yahoo-conversions-api.body.hashed_plaintext_field`	docs
`body.privacy_requires_consent`	required	GPP and GDPR privacy modes require their respective consent string. Body scope: [].	`vendor.yahoo-conversions-api.body.privacy_requires_consent`	docs
`body.gpp_requires_section_ids`	required	GPP privacy mode requires the list of active GPP section IDs. Body scope: [].	`vendor.yahoo-conversions-api.body.gpp_requires_section_ids`	docs
`body.optout_forbids_consent`	required	OPTOUT privacy mode must omit the consent string. Body scope: [].	`vendor.yahoo-conversions-api.body.optout_forbids_consent`	docs
`body.event_time_window`	required	Yahoo rejects future event timestamps and events older than30 days. Body scope: [].	`vendor.yahoo-conversions-api.body.event_time_window`	docs
`body.click_identifiers_exclusive`	required	Yahoo Click ID and Taboola Click ID are mutually exclusive within one event. Body scope: [].	`vendor.yahoo-conversions-api.body.click_identifiers_exclusive`	docs
`body.gdpr_consent_valid`	required	GDPR mode requires a decodable TCFv2 consent string. Body scope: [].	`vendor.yahoo-conversions-api.body.gdpr_consent_valid`	docs
`body.gpp_consent_valid`	required	GPP mode requires a structurally valid GPP encoding and header. Body scope: [].	`vendor.yahoo-conversions-api.body.gpp_consent_valid`	docs
`body.gpp_sections_present`	required	Every active GPP section ID must be encoded in the structurally valid consent string. Body scope: [].	`vendor.yahoo-conversions-api.body.gpp_sections_present`	docs
`method`	required	The documented Standard CAPI operation uses POST. Complete HTTP capture contract. Native JSON type: string.	`vendor.yahoo-conversions-api.http.method.missing` `vendor.yahoo-conversions-api.http.method.empty` `vendor.yahoo-conversions-api.http.method.invalid`	docs
`content_type`	recommended	Yahoo documents application/json and reports unsupported Content-Type. Missing MIME and alternative types receive advice without treating examples as an exhaustive receiver contract. Complete HTTP capture contract. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.yahoo-conversions-api.http.content_type.missing` `vendor.yahoo-conversions-api.http.content_type.empty` `vendor.yahoo-conversions-api.http.content_type.invalid`	docs
`headers.authorization`	recommended	OAuth is required in the current guide. Its historical error table notes nonenforcement in the initial release, so missing or non-Bearer captures receive advice. Token signature, lifetime and account approval remain external. Complete HTTP capture contract. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.yahoo-conversions-api.http.headers.authorization.missing` `vendor.yahoo-conversions-api.http.headers.authorization.empty` `vendor.yahoo-conversions-api.http.headers.authorization.invalid`	docs
`body_encoding`	recommended	The published profile sends a JSON entity. Opaque compressed captures stay unverified; query-only alternatives mentioned by a generic error are not reinterpreted as this JSON profile. Complete HTTP capture contract. Applies when {"kind":"all","conditions":[{"kind":"not","condition":{"kind":"value_in","param":"body_encoding","values":["unsupported"]}},{"kind":"any","conditions":[{"kind":"value_in","param":"body_encoding","values":["none"]},{"kind":"value_in","param":"content_type","values":["application/json"]}]}]}. Presence diagnostic severity: warning.	`vendor.yahoo-conversions-api.http.body_encoding.missing` `vendor.yahoo-conversions-api.http.body_encoding.empty` `vendor.yahoo-conversions-api.http.body_encoding.invalid`	docs
`url`	optional	The published Standard CAPI endpoint uses HTTPS. This is transport advice, not a claim about redirect or receiver behavior. Complete HTTP capture contract. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.yahoo-conversions-api.http.url.empty` `vendor.yahoo-conversions-api.http.url.invalid`	docs

Validate a payload

pixellint validate request @request.json --rulepack vendor/yahoo-conversions-api

Try this failing payload in the playground. An example with a validation finding.

{
  "url": "https://batch.datax.yahoo.com/v1/events/10157549",
  "method": "POST",
  "headers": {
    "Content-Type": "application/json"
  },
  "body": "[{\"eventTs\":1792886400,\"actionSource\":\"web\",\"userData\":{\"email\":[\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"]},\"eventName\":\"purchase\"}]"
}

cargo install pixellint · npm install pixellint