Saves code review findings from the customer's repository to the audit: server-side events, dedup IDs, Pixel and container presence, payment provider, framework, backend location and existing Conversions API quality, plus the relative paths reviewed and any inapplicable checks with reasons. Unknown values stay unknown, not failed. Findings are stored as agent-reported, not verified deployed behavior. A group label is a label only; each report stays separate. Returns the updated audit decision and report link.
View input schema
{
"type": "object",
"properties": {
"audit_id": {
"description": "audit run ID returned by Tyton; each audit run has its own ID",
"type": "string",
"pattern": "^audit-[a-f0-9]{32}$"
},
"audit_key": {
"description": "private audit write capability returned by Tyton; a secret that authorizes changes to this audit only",
"type": "string",
"pattern": "^[a-f0-9]{64}$"
},
"revision": {
"description": "latest run revision; 0 for the first write of a new audit session, then the revision returned by the previous write",
"type": "integer",
"minimum": 0
},
"request_id": {
"description": "UUID identifying one mutation; a repeated request_id with identical content is treated as a retry",
"type": "string",
"format": "uuid"
},
"url": {
"description": "the site these findings belong to",
"type": "string",
"format": "uri"
},
"reviewed_files": {
"description": "relative paths actually inspected in the relevant customer repository; no source code, absolute paths or secret files",
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"maxLength": 160
},
"maxItems": 30
},
"not_applicable": {
"description": "Inapplicable checks, each with the actual reason, based on reviewed files and confirmed scope. Missing access counts as unknown, not N/A.",
"type": "array",
"items": {
"type": "object",
"properties": {
"check": {
"enum": [
"C1",
"C2",
"C4",
"C5",
"C4a",
"C4b",
"C4d",
"C4e"
],
"type": "string"
},
"reason": {
"type": "string",
"minLength": 1,
"maxLength": 160
}
},
"required": [
"check",
"reason"
]
},
"maxItems": 8
},
"server_side_events": {
"enum": [
"yes",
"no",
"unknown"
],
"description": "code sends server-side events (CAPI/SDK/webhook)? unknown when not checked",
"type": "string"
},
"server_evidence": {
"description": "one line: file/function where it was found",
"type": "string",
"maxLength": 300
},
"dedup_ids": {
"enum": [
"yes",
"no",
"unknown"
],
"description": "orderId/event_id on both browser and server events?",
"type": "string"
},
"pixel_in_code": {
"enum": [
"yes",
"no",
"unknown"
],
"description": "Meta Pixel initialized anywhere in the code?",
"type": "string"
},
"container_in_code": {
"enum": [
"yes",
"no",
"unknown"
],
"description": "Tyton container script embedded?",
"type": "string"
},
"payment_provider": {
"enum": [
"stripe",
"lemonsqueezy",
"paddle",
"gumroad",
"shopify",
"polar",
"other",
"none",
"unknown"
],
"description": "payment processor used (from package.json, env vars, webhook routes)",
"type": "string"
},
"framework": {
"enum": [
"nextjs",
"nuxt",
"astro",
"remix",
"sveltekit",
"vite",
"cra",
"plain_html",
"other"
],
"description": "frontend framework (from package.json deps)",
"type": "string"
},
"backend": {
"enum": [
"in_repo",
"separate_repo",
"unknown"
],
"description": "where the backend code is: in this repo, a separate repo not available here, or unknown",
"type": "string"
},
"existing_capi": {
"description": "grades for existing CAPI code, if any: hashes_pii (does it hash emails/phones before sending?), sends_event_id (does each server event include an event_id?), graph_version (which Graph API version, e.g. v19.0), test_event_code_in_prod (is a test code left in production?), sends_fbp_fbc (are browser cookie values forwarded?)",
"type": "object",
"properties": {
"hashes_pii": {
"enum": [
"yes",
"no",
"unknown"
],
"description": "emails/phones hashed before sending?",
"type": "string"
},
"sends_event_id": {
"enum": [
"yes",
"no",
"unknown"
],
"description": "event_id sent with server events?",
"type": "string"
},
"graph_version": {
"description": "Graph API version used, e.g. v19.0",
"type": "string",
"maxLength": 10
},
"test_event_code_in_prod": {
"enum": [
"yes",
"no",
"unknown"
],
"description": "test_event_code left in production code?",
"type": "string"
},
"sends_fbp_fbc": {
"enum": [
"yes",
"no",
"unknown"
],
"description": "fbp/fbc cookie values forwarded in server events?",
"type": "string"
}
}
},
"checkout_domains": {
"description": "domains the checkout lives on, if separate; no customer paths or query strings",
"type": "array",
"items": {
"type": "string",
"maxLength": 253
},
"maxItems": 20
},
"group": {
"description": "legacy grouping label only; does not combine reports or verify domain ownership",
"type": "string",
"maxLength": 80
},
"notes": {
"description": "anything else found; a string or an array of strings",
"anyOf": [
{
"type": "string",
"maxLength": 2000
},
{
"type": "array",
"items": {
"type": "string",
"maxLength": 160
},
"maxItems": 10
}
]
}
},
"required": [
"url"
]
}