What Prebid traffic looks like
Prebid.js is not a vendor endpoint. It is the header-bidding wrapper publishers embed to run client-side ad auctions, and on the wire it is two-layered.
- Endpoint pattern
- The wrapper itself: a script load, usually a renamed or bundled
prebid.js(often split intopbjsChunklazy chunks), exposing thepbjsglobal; the auction: parallel bid requests to every configured bidder adapter (bidder.criteo.com, AppNexus, Rubicon), each on the bidder's own hostname - Transport
- Script load for the wrapper; when the page calls
pbjs.requestBids(), Prebid fans out bid requests in each bidder's own request format - Key parameters
- Ad unit codes and sizes from the publisher's
pbjs.addAdUnits()config · floor and currency · consent payload: a TCFgdpr_consentstring and/orus_privacy· user IDs from Prebid's user ID modules (SharedID, ID5), piggybacking on every bidder call - Payload
- The winning bid flows to the ad server, typically GAM via key-values like
hb_pbandhb_adid
Debugging Prebid with Event Watcher
- Detects the wrapper from its script patterns (
/prebid.js,pbjs.,pbjsChunk) and shows it as a Prebid script-load event with the raw request details; there is no dedicated parser. - The real value is contextual: each downstream bidder Event Watcher knows fires as its own platform, so Grouped view by Tool shows the whole bidder roster the auction reached.
- The Script Tree view shows Prebid as the parent that loaded the adapters.
Prebid and consent
Marketing consentThe extension checks Prebid against the marketing consent category. Correctly configured, Prebid's consent management module waits for the CMP, attaches the TCF string to every bid request, and bidders decide server-side what they may do.
Failure modes: auctions that start before the CMP answers (bid requests with an empty consent string, flagged pre-consent) and misconfigured timeouts that proceed as if consent were denied; compare bid-traffic consent badges against the CMP's recorded state.
Common debugging scenarios
- Bids fire before the CMP answers. Filter to violations and look at the earliest bidder requests. Pre-consent badges on bid traffic mean the consent management module's timeout or CMP hookup is wrong.
- A bidder is configured but never called. Group by Tool and compare the bidder roster on the page against the ad ops spreadsheet; absent bidders never left the wrapper.
- Which script actually loaded Prebid? Script Tree shows whether the wrapper came from the site, a CMS ad plugin, or a managed wrapper service.
- User ID modules leaking IDs. Inspect bid request parameters for ID5 or SharedID values on requests marked consent-denied.
- Auction runs but no ads render. Confirm the ad server request follows the bid burst. If bids fire and the GAM call never carries
hb_targeting, the handoff is the problem, not the auction.