Activity

1. aram356

   added a parent issue on Nov 17, 2025

   • Lockr support for data identity provider #89
2. aram356

   added the

   Task

   issue type on Nov 17, 2025
3. aram356

   assigned

   ChristianPavilonis

   on Nov 17, 2025
4. ChristianPavilonis commented on Nov 18, 2025

   

   ChristianPavilonis

   on Nov 18, 2025

   Last edited by ChristianPavilonis

   Collaborator

   More actions

   Here's a summary of all the lockr outbound requests. I also have a full doc of all that their JS does. to test on prospecta you'll need to connect to a vpn where gdpr rules apply.

   The SDK may require connection from specific geographic regions (EU/UK) to function. Testing revealed that requests to identity.loc.kr only occur when:

   1. ✅ Connected via VPN to UK/EU region
   2. ✅ Cookie consent banner accepted (TCF consent)
   3. ✅ Valid app_id meta tag present
   4. ✅ No privacy signals blocking (DNT, GPC)

   Without meeting these conditions, the SDK will initialize but make zero API requests.

   ---

   API Requests Made to identity.lockr.kr

   When properly initialized, the SDK makes the following requests to https://identity.loc.kr:

   1. Settings Retrieval (First Request)

   POST /publisher/app/v1/identitylockr/settings
   

   Triggered by: Automatic on successful initialization
   Purpose: Fetch configuration (which identity providers to enable, tracking settings)
   Request Body:

   {
     "appID": "uuid-from-meta-tag"
   }

   Response includes:

   • Which identity SDKs to inject (ID5, First ID, LiveRamp, etc.)
   • Cookie and UTM parameter names to monitor
   • Geographic data (IP, country, city, lat/long)
   • Device data (OS, browser, hashed user agent)

   ---

   2. Page View Tracking (Second Request)

   POST /publisher/app/v1/identitylockr/page-view
   

   Triggered by: Automatic after settings request completes
   Purpose: Report page view and receive advertising tokens
   Request Body:

   {
     "appID": "uuid",
     "lockrTrackingID": "uuid-tracking-id",
     "domain": "example.com",
     "url": "https://example.com/page",
     "firstPartyCookies": "cookie1=val1;cookie2=val2",
     "utmTags": "utm_source=google,utm_medium=cpc",
     "consentString": "CPX...",
     "tokens": {
       "UID": "existing_uid2_token",
       "ID5": "existing_id5_token"
     }
   }

   Response includes:

   • New advertising tokens (UID2, EUID, ID5, RAMPID, etc.)
   • Token expiry timestamps
   • Content classification data (IAB categories)

   ---

   3. Token Generation (On-Demand)

   POST /publisher/app/v1/identitylockr/generate-tokens
   

   Triggered by: Publisher calls window.lockr.additionalData({ type: 'email', value: 'user@example.com' })
   Purpose: Generate identity tokens from user PII (email, phone, etc.)
   Request Body:

   {
     "appID": "uuid",
     "data": {
       "type": "email",
       "value": "user@example.com",
       "isEncrypted": false,
       "meta": {
         "firstName": "John",
         "lastName": "Doe"
       }
     },
     "lockrTrackingID": "uuid",
     "firstPartyCookies": "...",
     "consentString": "..."
   }

   ---

   4. Token Refresh (Automatic)

   POST /publisher/app/v1/identitylockr/refresh-tokens
   

   Triggered by: Every 1 second, checks for expired tokens and auto-refreshes
   Purpose: Refresh expired identity tokens
   Automatic behavior: Monitors localStorage expiry timestamps

   ---

   5. No-HEM ID Sync (Automatic)

   POST /publisher/app/v1/identitylockr/sync-no-hem-ids
   

   Triggered by:

   • After ID5 SDK generates a new token
   • After First ID SDK generates a new token
   • After Panorama (Lotame) generates a new token

   Purpose: Sync non-hashed identity tokens back to Lockr backend
   Side effect: Creates __aim_i, __aim_f, __aim_p cookies with SHA-256 hashed values

   ---

   6. Data Enrichment (IrisTV) (Automatic)

   POST /publisher/app/v1/identitylockr/dataenrichment
   

   Triggered by: Automatic if isIrisTVEnabled: true in settings
   Purpose: Send video IDs for content classification
   Behavior:

   • Scans page for video players (JW Player, Video.js, Plyr, Bitmovin, YouTube, Vimeo, etc.)
   • Extracts video IDs
   • Sends to backend for IrisTV classification
   • Stores results in irisid and iriscat cookies

   ---

   7. Consent Revocation (On Privacy Signal)

   POST /publisher/app/v1/identitylockr/revoke-consent
   

   Triggered by:

   • navigator.doNotTrack enabled
   • navigator.globalPrivacyControl enabled
   • TCF consent denied/revoked
   • CCPA opt-out (USPAPI string 1YYN)
   • GPP privacy signal

   Side effect: Clears all localStorage and cookies

   ---

   8. Pending Request Processing (Resume)

   POST /publisher/app/v1/identitylockr/pending-token-request
   

   Triggered by: On page load if localStorage.aim_pending_g_request exists
   Purpose: Resume interrupted token generation from previous session

   ---

   9. Incorrect Data Reporting (Quality Control)

   POST /publisher/app/v1/identitylockr/incorrect-data-found
   

   Triggered by: Automatic if configured cookie/UTM names have 80-100% string similarity but don't exactly match
   Purpose: Quality control - reports configuration mismatches to backend

   Initiator data

   All the requests I've seen are self initiated by the identity-lockr-v1.0.js script
5. aram356 commented on Dec 15, 2025

   

   aram356

   on Dec 15, 2025

   CollaboratorAuthor

   More actions

   🔧 @ChristianPavilonis Can we add initiators to the list of request?
6. aram356

   closed this as completedon Dec 29, 2025