Yahoo CAPI events need a pixel ID, eventTs, and a match key
The Standard Conversion API posts a JSON array to /v1/events/{pixelId}. eventTs is seconds or milliseconds. userData needs hashed email, phone, gpsaid, idfa, or pxid, or clickData. Dot image pixels stay vendor/yahoo-dot.
The pixel ID is a path segment
A POST to /v1/events with no pixel ID is not tied to a DSP pixel.
What this pack matches
Rules
Codes are stable. A finding in CI, MCP, or the playground lands on the same id.
| Field | Required | What it checks | Rule ids | Source |
|---|---|---|---|---|
pixel_id |
required | It is the Yahoo DSP pixel ID. Yahoo documents the batch endpoint as /v1/events/{pixelId}. Fix: Put the DSP pixel ID in the path, such as /v1/events/10157549. Do not reuse a live Dot pixel ID. | vendor.yahoo-conversions-api.param.pixel_id.missingvendor.yahoo-conversions-api.param.pixel_id.emptyvendor.yahoo-conversions-api.param.pixel_id.invalid |
docs |
root |
optional | The Standard CAPI request body is an array of event objects. Native JSON type: array. Minimum array items: 1. | vendor.yahoo-conversions-api.body.root.invalid |
docs |
[] |
optional | The vendor documents the JSON shape or value type of this field. Native JSON type: object. | vendor.yahoo-conversions-api.body.[].invalid |
docs |
eventTs |
required | It is the event time in seconds or milliseconds. Yahoo documents eventTs as required. Body scope: []. Native JSON type: integer. Fix: Set eventTs to a Unix timestamp in seconds or milliseconds. | vendor.yahoo-conversions-api.body.eventTs.missingvendor.yahoo-conversions-api.body.eventTs.emptyvendor.yahoo-conversions-api.body.eventTs.invalid |
docs |
eventName |
required | It is the event action name. Yahoo documents eventName as required. Body scope: []. Native JSON type: string. Fix: Set eventName to the action the DSP rule matches, such as addToCart or Purchase. | vendor.yahoo-conversions-api.body.eventName.missingvendor.yahoo-conversions-api.body.eventName.emptyvendor.yahoo-conversions-api.body.eventName.invalid |
docs |
actionSource |
required | It is the digital or physical source of the event. Yahoo documents actionSource as required. Body scope: []. Native JSON type: string. Fix: Set actionSource to a source such as web, app, phone, email, online, or physical_store. | vendor.yahoo-conversions-api.body.actionSource.missingvendor.yahoo-conversions-api.body.actionSource.emptyvendor.yahoo-conversions-api.body.actionSource.invalid |
docs |
eventId |
optional | It is the advertiser's event id. Yahoo documents it as optional, and duplicate ids are dropped. Body scope: []. Native JSON type: string. Fix: Send a unique `eventId` per conversion, or drop the empty pair. | vendor.yahoo-conversions-api.body.eventId.emptyvendor.yahoo-conversions-api.body.eventId.invalid |
docs |
actionSourceUrl |
optional | It is the page URL where the conversion happened. Yahoo documents it as optional, and null for some sources such as phone or physical_store. Body scope: []. Native JSON type: string or null. Fix: Send an absolute URL in `actionSourceUrl`, or omit it. | vendor.yahoo-conversions-api.body.actionSourceUrl.emptyvendor.yahoo-conversions-api.body.actionSourceUrl.invalid |
docs |
country |
optional | It is the country of the event. Yahoo documents two characters, such as `US`. Body scope: []. Fix: Send a two-letter country code such as `US`. | vendor.yahoo-conversions-api.body.country.emptyvendor.yahoo-conversions-api.body.country.invalid |
docs |
userData |
required | It is the wrapper for match keys. Yahoo documents userData as required, with at least one ID or clickData. Body scope: []. Native JSON type: object. Fix: Send a userData object with hashed email, phone, device ID, or pxid, or send clickData. | vendor.yahoo-conversions-api.body.userData.missingvendor.yahoo-conversions-api.body.userData.invalid |
docs |
userData.email |
optional | Email must be lowercased and SHA-256 hashed. Yahoo documents userData.email as a list of hashes. Body scope: []. Native JSON type: array. Minimum array items: 1. Fix: Lowercase the email, hash it with SHA-256, and send 64 lowercase hex characters. | vendor.yahoo-conversions-api.body.userData.email.invalid |
docs |
userData.email[] |
optional | Every email in the list must be SHA-256 hashed. Body scope: []. Native JSON type: string. Fix: Lowercase each email, hash it with SHA-256, and send the hex digests. | vendor.yahoo-conversions-api.body.userData.email[].emptyvendor.yahoo-conversions-api.body.userData.email[].invalid |
docs |
userData.phone |
optional | Phone numbers must be SHA-256 hashed. Yahoo documents userData.phone as a list of hashes. Body scope: []. Native JSON type: array. Minimum array items: 1. Fix: Hash the phone number with SHA-256 and send 64 lowercase hex characters. | vendor.yahoo-conversions-api.body.userData.phone.invalid |
docs |
userData.phone[] |
optional | Every phone number in the list must be SHA-256 hashed. Body scope: []. Native JSON type: string. Fix: Hash each phone number with SHA-256 and send the hex digests. | vendor.yahoo-conversions-api.body.userData.phone[].emptyvendor.yahoo-conversions-api.body.userData.phone[].invalid |
docs |
userData.gpsaid |
optional | It is a list of Android advertising IDs. Body scope: []. Native JSON type: array. Minimum array items: 1. | vendor.yahoo-conversions-api.body.userData.gpsaid.invalid |
docs |
userData.idfa |
optional | It is a list of Apple advertising IDs. Body scope: []. Native JSON type: array. Minimum array items: 1. | vendor.yahoo-conversions-api.body.userData.idfa.invalid |
docs |
userData.pxid |
optional | It is a partner match ID. Yahoo documents the form `pxIdSrcId:pxIdValue`. Body scope: []. Native JSON type: array. Minimum array items: 1. Fix: Send `userData.pxid` as `sourceId:value`, such as `999:XY50038zETeXJBOYNTRn7Z3T6VSkxDF5ZpRz3wvPEVmt1ZXHo`. | vendor.yahoo-conversions-api.body.userData.pxid.invalid |
docs |
userData.pxid[] |
optional | Every partner match ID in the list must be `sourceId:value`. Body scope: []. Fix: Send each `pxid` as `sourceId:value`. | vendor.yahoo-conversions-api.body.userData.pxid[].emptyvendor.yahoo-conversions-api.body.userData.pxid[].invalid |
docs |
userData.ip_address |
optional | It is the device IP address. Yahoo documents it as unhashed. Body scope: []. Native JSON type: string. Fix: Send the raw IP in `userData.ip_address`, not a digest. | vendor.yahoo-conversions-api.body.userData.ip_address.emptyvendor.yahoo-conversions-api.body.userData.ip_address.invalid |
docs |
userData.userAgent |
optional | It is the browser user agent. Yahoo documents it as the HTTP header, unhashed. Body scope: []. Native JSON type: string. Fix: Send the raw user agent in `userData.userAgent`, not a digest. | vendor.yahoo-conversions-api.body.userData.userAgent.emptyvendor.yahoo-conversions-api.body.userData.userAgent.invalid |
docs |
eventData.price |
optional | It is the conversion value. Yahoo documents a number, assumed USD when no currency is sent. Body scope: []. Native JSON type: number. Fix: Send `eventData.price` as a number such as `12.99`. | vendor.yahoo-conversions-api.body.eventData.price.invalid |
docs |
clickData.vmcid |
optional | It is the Yahoo Click ID. Yahoo documents clickData as a match key when user IDs are not available. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.clickData.vmcid.emptyvendor.yahoo-conversions-api.body.clickData.vmcid.invalid |
docs |
clickData.tblci |
optional | It is the Taboola Click ID. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.clickData.tblci.emptyvendor.yahoo-conversions-api.body.clickData.tblci.invalid |
docs |
root |
optional | Each event is a JSON object, rather than a scalar or list. Body scope: []. Native JSON type: object. | vendor.yahoo-conversions-api.body.root.invalid |
docs |
eventData |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: object. | vendor.yahoo-conversions-api.body.eventData.invalid |
docs |
clickData |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: object. | vendor.yahoo-conversions-api.body.clickData.invalid |
docs |
privacy |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: object. | vendor.yahoo-conversions-api.body.privacy.invalid |
docs |
userData.gpsaid[] |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.userData.gpsaid[].emptyvendor.yahoo-conversions-api.body.userData.gpsaid[].invalid |
docs |
userData.idfa[] |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.userData.idfa[].emptyvendor.yahoo-conversions-api.body.userData.idfa[].invalid |
docs |
region |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.region.invalid |
docs |
privacy.privacy_type |
required | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.privacy.privacy_type.missingvendor.yahoo-conversions-api.body.privacy.privacy_type.emptyvendor.yahoo-conversions-api.body.privacy.privacy_type.invalid |
docs |
privacy.consent_string |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.privacy.consent_string.emptyvendor.yahoo-conversions-api.body.privacy.consent_string.invalid |
docs |
privacy.gpp_sid |
optional | GPP requires one or two active section IDs. Yahoo rejects more than two. Section correspondence and Yahoo-supported section policy are separate checks. Body scope: []. Native JSON type: array. Minimum array items: 1. Maximum array items: 2. | vendor.yahoo-conversions-api.body.privacy.gpp_sid.invalid |
docs |
privacy.gpp_sid[] |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: integer. | vendor.yahoo-conversions-api.body.privacy.gpp_sid[].invalid |
docs |
eventData.products |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: array. | vendor.yahoo-conversions-api.body.eventData.products.invalid |
docs |
eventData.products[] |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: object. | vendor.yahoo-conversions-api.body.eventData.products[].invalid |
docs |
eventData.products[].category |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.eventData.products[].category.invalid |
docs |
eventData.products[].subCategory |
optional | The vendor documents the JSON shape or value type of this field. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.eventData.products[].subCategory.invalid |
docs |
eventData.customKeyValues |
optional | The published vendor reference specifies this field. Body scope: []. Native JSON type: object. | vendor.yahoo-conversions-api.body.eventData.customKeyValues.invalid |
docs |
eventData.customKeyValues.* |
optional | The published vendor reference specifies this field. Body scope: []. Native JSON type: string. | vendor.yahoo-conversions-api.body.eventData.customKeyValues.*.invalid |
docs |
body.unhashed_email |
required | A field carries what looks like a raw email address. Yahoo documents userData.email as SHA-256 hashed, lowercased values. Body scope: []. Fix: Lowercase the email, hash it with SHA-256, and send the hex digest in userData.email. | vendor.yahoo-conversions-api.body.unhashed_email |
docs |
body.user_needs_an_identifier |
required | The event has no match key. Yahoo documents at least one of hashed email, phone, gpsaid, idfa, pxid, or clickData. Body scope: []. Fix: Send hashed userData.email, phone, gpsaid, idfa, or pxid, or send clickData.vmcid or clickData.tblci. | vendor.yahoo-conversions-api.body.user_needs_an_identifier |
docs |
body.hashed_plaintext_field |
required | This field looks like a SHA-256 digest, but Yahoo documents `userData.ip_address` and `userData.userAgent` as unhashed. Body scope: []. Fix: Send the raw IP address or user agent. Hashing it makes the event unmatchable. | vendor.yahoo-conversions-api.body.hashed_plaintext_field |
docs |
body.privacy_requires_consent |
required | GPP and GDPR privacy modes require their respective consent string. Body scope: []. | vendor.yahoo-conversions-api.body.privacy_requires_consent |
docs |
body.gpp_requires_section_ids |
required | GPP privacy mode requires the list of active GPP section IDs. Body scope: []. | vendor.yahoo-conversions-api.body.gpp_requires_section_ids |
docs |
body.optout_forbids_consent |
required | OPTOUT privacy mode must omit the consent string. Body scope: []. | vendor.yahoo-conversions-api.body.optout_forbids_consent |
docs |
body.event_time_window |
required | Yahoo rejects future event timestamps and events older than30 days. Body scope: []. | vendor.yahoo-conversions-api.body.event_time_window |
docs |
body.click_identifiers_exclusive |
required | Yahoo Click ID and Taboola Click ID are mutually exclusive within one event. Body scope: []. | vendor.yahoo-conversions-api.body.click_identifiers_exclusive |
docs |
body.gdpr_consent_valid |
required | GDPR mode requires a decodable TCFv2 consent string. Body scope: []. | vendor.yahoo-conversions-api.body.gdpr_consent_valid |
docs |
body.gpp_consent_valid |
required | GPP mode requires a structurally valid GPP encoding and header. Body scope: []. | vendor.yahoo-conversions-api.body.gpp_consent_valid |
docs |
body.gpp_sections_present |
required | Every active GPP section ID must be encoded in the structurally valid consent string. Body scope: []. | vendor.yahoo-conversions-api.body.gpp_sections_present |
docs |
Validate a payload
pixellint validate json @payload.json --rulepack vendor/yahoo-conversions-apiTry this failing payload in the playground. Yahoo CAPI missing eventName.
[{"eventTs":1733508168,"actionSource":"web","userData":{"email":["536a09742acb5b4ec7c7d6c0e20a5d3f4318817817353b69f8ee15f27d3fc9fa"]}}]
cargo install pixellint
·
npm install pixellint