OpenRTB 2.6 Protocol Guide & Diagnostics | adtechpilot.fun

Santosh Mahanty

Interactive Protocol Guide

OpenRTB 2.6 Deep Dive

Learn how programmatic bid requests and responses work under the hood. Master auction mechanics, privacy compliance parameters, and step-by-step diagnostic workflows for AdOps and Solution Engineers.

⚡ Launch Validator Tool Explore Auction Flow View Sample JSON Troubleshooting

Core Protocol Track

Understand the universal language of programmatic auctions

OpenRTB 2.6 is the protocol powering billions of ad auctions every day. This guide decodes every request field into plain English, showing you how DSPs evaluate impressions, why no-bids happen, and how to debug revenue drops.

What you'll learn

Every core OpenRTB 2.6 object (imp, site/app, device, user, regs, source)
How consent strings and identity graphs unlock or restrict DSP budgets
Win/loss notification mechanics: nurl vs burl, price macros, and loss codes

What is inside

Field-by-field annotated JSON request and response payloads
Object reference tables with required status and revenue impact
Top 6 real-world troubleshooting scenarios with step-by-step fixes

How to use this guide

Compare this guide against live SSP/DSP bid logs in Charles or Fiddler
Use the field reference table to spot missing geo, consent, or device signals
Review the interview Q&A section before AdOps and Solution Engineer interviews

Think of OpenRTB like a real-time stock exchange ticker for advertising. Whenever a user opens a webpage or video app, the publisher sends a standardized digital description of the ad slot (its size, the user’s device, country, and privacy consent). Hundreds of Demand-Side Platforms (DSPs) read this description simultaneously, check if their advertisers want it, and submit price bids—all within 100 to 200 milliseconds.

How an OpenRTB Auction Works (6-Step Lifecycle)

From the moment an ad slot renders on screen to the moment the winning creative displays and triggers billing:

1
Ad Slot Trigger & SSP Payload Construction
The browser or app sends an ad request to the Supply-Side Platform (SSP). The SSP collects device parameters, page URL, consent strings, and slot dimensions into a standard OpenRTB 2.6 JSON object.
2
Fan-Out to DSPs (tmax Window)
The SSP sends this bid request over HTTP POST to all connected DSP endpoints. The request specifies tmax: 150 (150ms timeout window) so DSPs must respond before the timer expires.
3
DSP Evaluation & Targeting Match
Each DSP parses the request against active advertiser campaigns (geo, audience segments, floor price, brand safety categories, and frequency caps).
4
Bid Response Submission
Matching DSPs reply with a seatbid containing a bid price (e.g. $3.20 CPM), creative markup (adm), and a win notification URL (nurl). Non-matching DSPs return HTTP 204 (No-Bid).
5
Auction Clearing & Winner Selection
The SSP verifies that all bids meet the placement's minimum floor price (bidfloor). In a First-Price Auction (at: 1), the highest valid bid wins and clears at exactly its submitted price.
6
Win Notice & Creative Rendering
The winning ad markup renders in the user's browser. The SSP executes the DSP's nurl macro, substituting ${AUCTION_PRICE} so the DSP knows the exact clearing price for billing.

Annotated OpenRTB 2.6 Bid Request

Below is a realistic OpenRTB 2.6 JSON request covering display, device context, cookieless identity, and GDPR consent.

                    JSON
                    OpenRTB 2.6 — Bid Request (POST /bid)
                

{
  "id": "7d9b6c3a-1f4e-4b8a-9c2d-0e5f8a1b7c3e",   // Unique auction transaction ID
  "at": 1,                                              // 1 = First-Price Auction (Standard), 2 = Second-Price
  "tmax": 150,                                          // Timeout: DSP must respond within 150 milliseconds
  "cur": ["USD"],                                       // Currency array

  "imp": [
    {
      "id": "1",
      "banner": {
        "w": 300, "h": 250,
        "pos": 1,                                        // 1 = Above The Fold (ATF), 3 = Below The Fold (BTF)
        "api": [3, 5]                                   // 3=MRAID-2, 5=ORMMA, 7=OMID (Open Measurement)
      },
      "bidfloor": 1.50,                                 // Minimum CPM floor ($1.50 USD)
      "bidfloorcur": "USD",
      "secure": 1,                                      // 1 = Requires HTTPS creative assets
      "tagid": "ad-unit-sidebar-sticky"
    }
  ],

  "site": {
    "id": "pub-site-9821",
    "name": "AdTech Tech Journal",
    "domain": "adtechpilot.fun",
    "page": "https://adtechpilot.fun/pages/learning.php",
    "cat": ["IAB19-6", "IAB25-3"],                       // Content taxonomy category for brand safety
    "publisher": {
      "id": "pub-1049",
      "name": "Santosh Media Group"
    }
  },

  "device": {
    "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
    "ip": "198.51.100.42",                             // User IP (may be masked in EEA)
    "geo": {
      "country": "USA",
      "region": "CA",
      "city": "San Francisco",
      "zip": "94105",
      "type": 2                                         // 1=GPS, 2=IP-derived, 3=User-provided
    },
    "devicetype": 2,                                    // 1=Mobile/Tablet, 2=Desktop, 3=Connected TV
    "os": "Windows",
    "osv": "11",
    "language": "en"
  },

  "user": {
    "id": "usr-anon-884920",
    "buyeruid": "dsp-user-sync-9912",                  // DSP cookie sync ID
    "consent": "CPXxRfAPXxRfAAfKABENAfCIAP_AAH_AAAqIHItf...", // IAB TCF v2 consent string
    "ext": {
      "eids": [
        {
          "source": "liveramp.com",
          "uids": [{ "id": "XY6152bP...RampID", "atype": 3 }]
        },
        {
          "source": "uidapi.com",
          "uids": [{ "id": "2.01.AAAA...UID2", "atype": 1 }]
        }
      ]
    }
  },

  "regs": {
    "coppa": 0,                                         // 0 = Not COPPA restricted
    "ext": {
      "gdpr": 1,                                        // 1 = GDPR rules apply
      "us_privacy": "1YNN"                             // CCPA: 1=Ver, Y=Notice Given, N=No Opt-Out, N=LSPA
    }
  },

  "source": {
    "tid": "7d9b6c3a-1f4e-4b8a-9c2d-0e5f8a1b7c3e",  // Transaction ID for end-to-end tracing
    "pchain": "pub-1049:ssp-101:exchange-01"           // SupplyChain (SChain) validation
  }
}

OpenRTB 2.6 Core Objects Reference Table

Understand the function and revenue impact of every primary object in the OpenRTB payload:

Object	Key Fields	Function in Auction	Revenue Impact If Missing or Broken
imp (Impression)	`id, banner, video, bidfloor, secure, pos`	Defines the ad slot size, format, minimum floor price, and viewability position.	Critical Failure: Invalid imp format causes DSPs to drop the request entirely. Missing `bidfloor` can result in underpriced monetization.
site / app	`domain, page, bundle, cat, publisher`	Describes where the ad appears, domain transparency, and IAB content categories.	High: Domain mismatch triggers DSP anti-spoofing filters; missing `cat` prevents brand safety-conscious advertisers from bidding.
device	`ua, ip, geo, devicetype, os, lmt`	Contains user agent, IP address, country/region, and device hardware category.	High: Inaccurate geo prevents location-targeted campaigns; missing devicetype stops CTV or mobile-specific budget allocation.
user	`buyeruid, consent, ext.eids`	Carries synced buyer cookies, universal IDs (UID2, ID5, RampID), and IAB TCF consent strings.	Severe: In Europe, missing or invalid `consent` causes 90%+ of DSPs to return No-Bid due to GDPR penalties.
regs (Regulations)	`coppa, ext.gdpr, ext.us_privacy`	Signals legal compliance requirements (COPPA child protection, EU GDPR, California CCPA).	Legal & Revenue: Failure to set `coppa: 1` on child content causes compliance violations; missing GDPR flag causes demand drop.
source	`tid, schain, pchain`	Provides cryptographic transaction tracing and SupplyChain (SChain) seller verification.	Medium-High: Broken or missing SChain nodes cause DSPs with strict Sellers.json enforcement to reject bids.

Top 6 Real-World OpenRTB Failure Scenarios & Fixes

Practical diagnostic playbooks for TAMs, Solution Engineers, and AdOps teams:

🚫 1. 100% No-Bid Rate in European Traffic

Symptom: DSP bid rate drops to zero for EU visitors, but US traffic monetizes normally.

Root Cause: regs.ext.gdpr = 1 is set, but user.consent is null or contains an outdated TCF v1.1 string instead of TCF v2.2.

Fix: Verify CMP integration to ensure valid TCF v2.2 consent string is attached before firing the bid request.

📉 2. CTV Revenue Drop Due to Device Type Mismatch

Symptom: Smart TV app impressions clear at banner rates ($0.50 CPM instead of $18.00 CPM).

Root Cause: The SSP request sets device.devicetype = 1 (Desktop/Mobile) instead of devicetype = 3 (Connected TV) or passes a mobile User Agent.

Fix: Map the CTV app's hardware profile to send devicetype: 3 and proper IFA identifiers.

⏱️ 3. High Timeout Rate (>25% DSP Timeouts)

Symptom: Bids arrive from the DSP, but win notices (nurl) never fire and fill rate falls.

Root Cause: Request tmax is set too aggressively (e.g. 50ms) or network latency between publisher and DSP endpoint exceeds the timeout limit.

Fix: Increase tmax to 150–250ms and consider regional edge SSP routing.

🔒 4. Mixed Content & Broken Creative Assets

Symptom: Browser console shows "Mixed Content: blocked http://... in HTTPS page" and ad slot stays blank.

Root Cause: SSP set imp.secure = 1, but the DSP returned creative markup (adm) referencing insecure http:// image or tracker URLs.

Fix: Reject insecure bids at the SSP validation layer and notify the DSP partner to audit SSL asset paths.

🏷️ 5. Floor Price Mismatch (bids below floor)

Symptom: DSP submits bids at $2.00, but they are consistently disqualified by the auction engine.

Root Cause: Currency mismatch between imp.bidfloorcur = "EUR" and DSP bidding in "USD", or SSP applying a dynamic floor higher than published.

Fix: Standardize currency conversion rules and ensure dynamic floor rules are communicated via OpenRTB extensions.

🔗 6. SChain Validation Failure (ads.txt mismatch)

Symptom: Tier-1 programmatic buyers (DV360, The Trade Desk) stop spending on publisher inventory.

Root Cause: source.ext.schain lists seller IDs that do not match the publisher's public ads.txt and SSP sellers.json entries.

Fix: Synchronize schain.nodes seller IDs with ads.txt direct/reseller lines.

AdOps & Solution Engineer Interview Q&A Cheat Sheet

Direct, recruiter-ready answers to common OpenRTB technical interview questions:

Q: What is the difference between First-Price (at: 1) and Second-Price (at: 2) auctions?

In a First-Price Auction, the highest bidder wins and pays exactly the amount they bid ($5.00 bid = $5.00 clearing price). In a Second-Price Auction, the winner pays $0.01 above the second-highest bid. Programmatic moved universally to First-Price auctions to improve transparency and eliminate hidden auction fees.

Keywords: First-price, bid shading, clearing price transparency.

Q: What is the difference between nurl, burl, and lurl?

nurl (Win Notice URL): Fired by the SSP when a DSP wins the auction; can carry the creative markup or billing ping. burl (Billing URL): Fired only when the impression actually renders on screen (prevents paying for unrendered ads). lurl (Loss Notice URL): Fired to notify losing DSPs why they lost (e.g. price floor, creative timeout).

Keywords: nurl win notice, burl render verification, lurl loss reason code.

Q: How does OpenRTB handle cookieless identity resolution?

OpenRTB 2.6 uses the user.ext.eids (Extended Identifiers) array. Instead of relying solely on third-party cookie sync (user.buyeruid), publishers pass encrypted deterministic identifiers such as UID2 (Unified ID 2.0), ID5, or LiveRamp RampID with defined source and atype parameters.

Keywords: user.ext.eids, UID2, LiveRamp RampID, deterministic matching.

Q: What happens when tmax is exceeded?

When a DSP's response takes longer than tmax (e.g. 150ms), the SSP drops the bid response and proceeds with the auction using whatever bids arrived on time. The late bid is discarded with no error displayed to the user, and the DSP may receive a loss notification indicating timeout (Loss Code 2).

Keywords: tmax timeout window, dropped bid, loss code 2.