Server-side events · Platform reference
Yahoo Conversion API (Standard Yahoo Conversion API): events, fields and dedup rules
Yahoo's Conversion API posts batches of server events to a Yahoo DSP pixel ID at batch.datax.yahoo.com. Each event needs an eventTs, an eventName, an actionSource and user data or a click ID (vmcid, or Taboola's tblci). Events older than 30 days are rejected. Events most often arrive but don't count because no DSP rule matches the eventName, the request came back PARTIAL with some events dropped, or isTestEvent was left on.
Read from the official documentation on 9 November 2026. Sources are listed at the end.
Endpoint and authentication
POST https://batch.datax.yahoo.com/v1/events/{pixelId}
OAuth 2.0 client credentials. Sign a JWT (HS256), exchange it at POST /zts/v1/oauth2/token on id.b2b.yahooincapis.com, then send Authorization: Bearer <access_token>. Tokens last 60 minutes, and OAuth 1.0 isn't supported
Event names
Yahoo DSP has no fixed list: you name each conversion yourself, and what you send must match that name exactly.
| Event | Use it for |
|---|---|
| purchase | Example eventName value. eventName maps to the Action field of rules in Yahoo DSP. There's no fixed standard list |
| add_to_cart | Example eventName / DSP Action value |
| lead | Example eventName / DSP Action value |
Required and recommended fields
| Field | What it needs |
|---|---|
| eventTs | Required. Event time in seconds or milliseconds. Future times and times older than 30 days are rejected |
| eventName | Required. The event action that triggers DSP rules. Normalise to lowercase |
| actionSource | Required. Source of the event, e.g. web, app, phone, email, online, physical_store |
| userData | Required. At least one user ID, or clickData instead |
| privacy.privacy_type (when privacy is sent) | The privacy object is optional; if you send it, privacy_type is required: GPP, GDPR or OPTOUT (attribution-only mode). consent_string is required for GPP/GDPR and forbidden for OPTOUT; gpp_sid is required for GPP |
| eventId | Optional, but it's the dedup key. Events with a non-unique ID are dropped as duplicates |
| actionSourceUrl | Optional URL of the event |
| eventData.price | Optional conversion value. Assumed to be USD and reported as Dynamic Conversion Value in the DSP. No separate currency field is documented |
Match keys and hashing
| Key | Normalise and hash |
|---|---|
| userData.email | SHA-256. Lowercase the email before hashing, and the resulting hash must also be lowercase. Sent as an array |
| userData.phone | SHA-256, values normalised to lowercase. Sent as an array |
| userData.ip_address | Not hashed |
| userData.userAgent | Not hashed |
| userData.gpsaid | Android advertising ID, as is |
| userData.idfa | Apple advertising ID, as is |
| userData.pxid | Partner Match ID in the form pxIdSrcId:pxIdValue; Yahoo gives you the provider source ID |
Click ids
| Click id | Where it comes from |
|---|---|
| clickData.vmcid | Yahoo click ID. Used to match events when user IDs aren't available or permitted |
| clickData.tblci | Taboola click ID, also accepted. vmcid and tblci are mutually exclusive on one event (error DXOL400_MULITPLE_EVENT_CLICKDATA_FIELD), and clickData isn't accepted on product events |
Deduplication
- Send a unique eventId per conversion. If the ID isn't unique, Yahoo drops the duplicate events.
- Create a new pixel ID for CAPI. Don't reuse a pixel ID already firing on a live site, or conversion counts are duplicated.
- Yahoo doesn't document a dedup time window.
Time limits and batch sizes
- Events with an eventTs older than 30 days, or in the future, are rejected (DXOL400_INVALID_EVENT_TS_FIELD).
- Rate limits: 200 requests per second and 10 MB of data per second. Exceeding them returns 429.
- Access tokens expire after 60 minutes. A 401 means you need a new token.
How to test before you trust it
- isTestEvent flag: Set eventData.customKeyValues.isTestEvent to "true". The API still returns its response code, but the events are dropped from production
- API response body: 200 with success COMPLETE means every event was valid. 200 with success PARTIAL plus a message means some events were invalid and dropped. 400 lists the field error codes
Why events arrive but don't attribute
- No matching rule in Yahoo DSP: Yahoo's workflow has you create DSP rules (Action = eventName) before posting events, and eventName should be lowercase to match them.
- An HTTP 200 doesn't mean every event landed. A PARTIAL response means some events in the batch were invalid and dropped.
- isTestEvent left set to true in production silently drops every event from reporting.
- Sending both vmcid and tblci on one event gets it rejected, and clickData on product events is also rejected.
- eventData.price is read as USD. Sending other currencies' amounts there misreports value.
- Reusing the pixel ID that's already live on your site duplicates conversions. Use a dedicated CAPI pixel ID.
- Privacy errors fail the event: consent_string sent without privacy_type (INVALID_PRIVACY_TYPE), or privacy_type GPP/GDPR without its consent_string (MISSING_CONSENT_STRING) or GPP without gpp_sid (MISSING_GPP_SIDS).
- Backfills older than 30 days are rejected outright.
Sources
Platforms change these rules without notice. If a source says something different from this page, the source wins.