RTBlintAlpha

OpenRTB validator · open source · Apache 2.0

Validate OpenRTB
before it bids.

RTBlint checks OpenRTB bid requests against the published specification: malformed JSON, missing required fields, unknown and deprecated fields, moved paths, type mismatches, and documented enums. Version-aware across OpenRTB 2.0–3.0, from one Rust core that runs on your stack: at runtime, in CI, and in a browser tester.

Open the testerRead the docs
cargo install rtblintnpm install rtblint-corertblint validate request.json

Lint the topic. Leave the auction alone.

A bidstream is a Kafka topic. RTBlint reads it the way Kowl does: as another consumer, not a hop. Sample payloads, emit findings, never sit in the bid path. The CLI already lints NDJSON; this is that stream in the UI operators already have.

Topics openrtb.bid-request

4 partitions · 12.4M messages · 8.4k/s

OffsetPartitionTimestampKeyValueSize
Offset
1842902
Partition
0
Timestamp
2026-09-11 04:08:11.047
Key
req-91bf
Value encoding
JSON
Size
103 B
{
  "id": "req-91bf",
  "source": {
    "schain": {
      "ver": "1.0",
      "complete": 0,
      "nodes": [
        {
          "asi": "ssp.example",
          "hp": 1
        }
      ]
    }
  }
}

erroropenrtb.schain.incompletesource.schain.complete

Illustration. The engine is the CLI and gRPC sidecar. The auction is a different consumer group. This one only reads.

Spec deltas tracked

62+

Versions covered

2.0 → 3.0

Runs

On your stack

License

Apache 2.0

One validator, every OpenRTB version

The spec has evolved continuously since 2012. Fields move, deprecate, and appear with each release. RTBlint tracks those deltas so a finding always reflects the version you are validating against, not a single frozen snapshot.

2.0

2012

4

Unified display, mobile, and video around shared objects.

2.1

2012

3

Tier-2 categories, geo provenance.

2.2

2014

4

Native ads, video skip signaling.

2.3

2015

5

Native 1.1 alignment, refined enums.

2.4

2016

4

Audio, metric reporting.

2.5

2016

6

supplychain groundwork, source object.

2.6

2022–2025

29

Eight tracked snapshots: plcmt, DSA, GPP, durfloors, refresh.

3.0

2018

7

Layered model with AdCOM. Envelope and AdCOM 1.0 domain objects.

Each square is one tracked spec delta. OpenRTB 2.6 alone spans eight published snapshots from 2022 to 2025.

The errors that drop a request

A malformed bid request does not bid. RTBlint catches the structural mistakes that exchanges reject and bidders silently misread, each one mapped to the field that caused it.

structure

Malformed JSON & missing fields

Parse errors and absent required fields (imp, id, at) are caught before a request ever reaches an exchange.

schema

Unknown & deprecated fields

Fields not in the targeted version, and fields the spec has since deprecated, are flagged with the exact path.

drift

Moved paths across versions

When a field relocates between versions (placement → plcmt), RTBlint points to the new home.

types

Type mismatches

Integers where strings appear, objects where arrays belong: type errors that silently break bidding logic.

enums

Documented enum values

Values outside the documented set for fields like auction type and placement are reported against the spec.

versions

Version-aware checks

Validate against a specific OpenRTB version, or let RTBlint detect and check the latest tracked snapshot.

A rule ID and a path, not a guess

RTBlint does not just say a request is invalid. Each issue names the rule that fired and the exact JSON path, so it maps straight to the line to fix and stays stable enough to gate a build on.

warning

placement was superseded by plcmt in OpenRTB 2.6. Set plcmt for forward compatibility.

openrtb.2.5.moved.imp.video.placementimp.0.video.placement

Rule IDStable across releases. Suppress it, document it, or gate CI on it.
JSON pathThe exact location in your request, array indices and all.
Version tagWhich OpenRTB version the rule is anchored to.

Grounded in the spec, run on your terms

Derived from the published spec

Every rule traces to the IAB Tech Lab OpenRTB specification: required fields, deprecations, moves, and documented enums. Each finding cites the version it applies to.

Runs on your stack

The same Rust core sits next to the auction: CLI, library, and gRPC sidecar. The browser tester is how you try a payload. Runtime is where a bad request actually costs you. Tester payloads may be stored so the rules can be improved.

Stable rule IDs and JSON paths

Each issue carries a stable rule ID and the exact JSON path that tripped it, so a finding maps straight to the field to fix, in a report or in CI.

Same core on your stack, in CI, and in a browser tester

Available now

Rust CLI

rtblint validate request.json, with --stdin, --version, and --format json for CI. Same rules as the library and gRPC sidecar on the auction path.

CLI reference →
Available now

MCP server

A hosted Model Context Protocol server at rtblint.org/mcp, so an AI agent can validate OpenRTB payloads mid-conversation. Payloads sent there may be stored; local rtblint-mcp does not send them.

MCP setup →
Available now

Browser tester

Paste a bid request and validate instantly, client-side. Same engine you run on the stack. Tester payloads may be stored; see privacy and terms.

Open the tester →

Spec releases, decoded as they ship

Two-thirds of tested publisher homepages let every synthetic bot through. OpenRTB still treats device.ua as identity telemetry.

A June 2026 benchmark of 21,491 high-traffic domains found 65.3 percent stopped none of ten automated visitors and only 2.4 percent stopped all of them. More than seven in ten let a spoofed AI crawler string through. Buyers who classify invalid traffic from the bid request cannot see that gap on the landing page where forms and pixels fire.

Read the post →

Comscore uniques at a flagship publisher fell seventy-eight percent since 2021. OpenRTB site.domain did not shrink with them.

Status reporting on a September all-hands slide shows Business Insider averaging twenty-one million Comscore uniques in 2026 year-to-date, down from ninety-five million in 2021. Buyers who still buy open-web news on site.domain are pricing the same string while the measured audience behind it collapsed.

Read the post →

CTV pre-bid show targeting can splice a Content object from app.bundle alone while the exchange still forwards an empty content block.

OpenEPG DB 1.0 maps 375,000+ bundle variations to 580,000+ shows across 13,900+ FAST channels and returns OpenRTB 2.6 Content fields from app.bundle and device.ua with zero publisher opt-in. Buyers who QA only raw SSP logs still see title-blind requests after enrichment already ran upstream.

Read the post →

Where RTBlint is, and where it is going

  1. Shipped

    OpenRTB 2.x bid request & response validation

    Required fields, unknown and deprecated paths, type mismatches, and documented enums across the tracked 2.6 snapshots, plus bid response validation.

  2. Shipped

    CLI, library, gRPC sidecar, browser tester & hosted MCP

    The same Rust core on your stack (CLI, rtblint-core crate, npm, gRPC sidecar), in a browser tester, and as a hosted MCP server at rtblint.org/mcp. Hosted MCP payloads may be stored (identifiers stripped).

  3. Shipped

    OpenRTB 3.0 envelope + AdCOM 1.0 domain objects

    Layered 3.0 transport validation, plus the AdCOM catalog behind item.spec, bid.media, and request.context.

  4. Shipped

    Opt-in supply-chain resolution

    CLI --resolve --cache checks each payment hop against sellers.json and the publisher's ads.txt or app-ads.txt. The core stays offline.

  5. Shipped

    NDJSON stream lint

    CLI --batch --summary lints captured bid streams and ranks rule ids by how often they fire.

  6. Shipped

    Exchange dialect profiles

    Validate against a platform's documented protocol requirements on top of the spec. google-ab covers Authorized Buyers extras (at=3, Imp.ext.billing_id). prebid-server covers Prebid Server /openrtb2/auction extras (bidder or stored request per Imp, no wseat/bseat). xandr covers Microsoft Monetize extras. magnite covers xAPI identity fields.

  7. Shipped

    GitHub Action

    uses: aleksUIX/rtblint@<tag> downloads a prebuilt CLI and fails the job on spec errors.

  8. Planned

    Native Go & Python bindings

    The same Rust core embeddable directly in Go and Python ad-serving pipelines.

OpenRTB validation, answered

What is an OpenRTB validator?

An OpenRTB validator checks a programmatic bid request (or response) against the IAB Tech Lab OpenRTB specification. It reports malformed JSON, missing required fields, unknown or deprecated fields, moved paths, type mismatches, and out-of-range enum values, the structural mistakes that cause exchanges to drop a request or bidders to misread it. RTBlint does this version-aware, on your stack or in a browser tester, with a rule ID and JSON path on every finding.

Which OpenRTB versions does RTBlint support?

RTBlint carries object catalogs for OpenRTB 2.0 through 3.0. Rule depth is richest on the tracked 2.6 snapshots (2022 through 2025), which is where most live programmatic traffic sits today. You can validate against a specific version or let RTBlint check against the latest tracked snapshot.

Is RTBlint free and open-source?

Yes. RTBlint is open-source under the Apache 2.0 license. There is no account, no rate limit, and no paywall. The browser tester, the Rust core, and the CLI are all free.

Does RTBlint upload my bid request?

On the tester, validation runs in your browser via WebAssembly. Payloads you paste or type in the tester, and payloads an agent sends to rtblint.org/mcp, may be stored with device IDs, IPs, and consent strings stripped, so the rules can be improved and for research described in the terms. Submitted JSON is not published as a public dataset. Built-in samples are not sent. You can opt out on the tester; that opt-out does not cover hosted MCP. Local rtblint-mcp over stdio does not send payloads. See rtblint.org/privacy and rtblint.org/terms. The CLI, library, and gRPC sidecar do not send payloads.

Can I run RTBlint in CI or a pipeline?

Yes. RTBlint ships as a Rust CLI (rtblint validate <file.json>, or --stdin for piped input) with --version and --format json for version-aware, machine-readable output, so it drops into CI and pre-bid checks. The same core runs as a gRPC sidecar next to the auction. An MCP server is included. Native Go and Python bindings are on the roadmap.

Is RTBlint an official IAB validator?

No. RTBlint is an independent, open-source validator that checks bid requests against the published IAB Tech Lab OpenRTB specification. It is not affiliated with or operated by IAB Tech Lab.

Validate an OpenRTB bid request now

Try a payload here. Run the same core on your stack.

Open the testerGitHub