pixellint

Validator for pixels, postbacks, conversion API payloads, and tracking URLs, as a WASM-backed npm package. Same engine, same rule ids, and same evidence levels as the pixellint CLI. Paste a URL or a CAPI JSON body at pixellint.org.

npm install pixellint

import { validate, isOk, validateMany } from "pixellint";

const pixel = validate("https://www.facebook.com/tr?ev=Purchase");
isOk(pixel); // false: missing Pixel ID

const capi = validate(
  JSON.stringify({
    data: [{ event_name: "Purchase", event_time: 1770000000000, action_source: "website" }],
  }),
  { kind: "json" },
);
isOk(capi); // false: event_time is milliseconds, Meta wants seconds

const document = validateMany([
  "https://example.com/pixel?id=1#frag",
  "https://example.com/pixel?id=1#frag",
]);
document.summary.unique_artifacts; // 1

Every finding carries a stable code, a severity, a fix_hint, the byte range it applies to, and the document it came from:

const [finding] = pixel.reports.flatMap((report) => report.violations);

finding.severity;         // "error"
finding.source.level;     // "official_vendor"
finding.source.reference; // "https://developers.facebook.com/docs/meta-pixel/get-started"
finding.targets[0];       // { component: "whole_url", start: 0, end: 46, ... }

What it checks

• URL conformance, transport, credentials, fragments, and ad-tech macro handling
• IAB consent signals: TCF gdpr and gdpr_consent, the deprecated US Privacy string, and GPP gpp and gpp_sid
• Vendor parameter contracts for 129 endpoint families, including Meta Conversions API, TikTok Events API, Reddit CAPI, and the browser pixels
• Endpoint attribution for 119 vendor rows, so an unrecognized pixel still gets a name.

API

| Function | Returns | | --- | --- | | validate(artifact, options?) | The full validation summary | | validateMany(document) | Document report for extracted artifacts | | isOk(summary) | false when any error-severity finding is present | | rulepacks() | Every rulepack with its evidence level | | vendors() | The vendor endpoint directory | | vendorForHost(host) | The vendor that serves a host, or null | | version() | The pixellint-core version this build wraps |

options takes kind (url by default, plus json, vast, postback, request, unknown), state (unknown, template, fired), and vendor for a caller's claimed vendor. html, js, and gtm throw: extract URLs first.

Templates keep their macros: pass { state: "template" } and unexpanded macros stop being findings.

Links

• Playground
• Conversion API validator
• Pixel not firing
• Rule inventory
• Writing a rulepack

Apache-2.0. Not affiliated with any vendor named in its rulepacks.