Serve the pixel-ID / token / test-code rules the API enforces.The merchant hub drives its client-side validation from this instead of retyping the regexes. That is the whole point: the same rules used to live as literals in three repos and they drifted — a real 17-digit Meta Pixel ID was rejected by a ^\d{15,16}$ whitelist in the hub AND here, while the storefront accepted it. With the API as the authority a rule can be loosened without a frontend deploy, and the hub can never be stricter than the endpoint it posts to.Store-scoped only for auth symmetry with the rest of the tracking panel; the payload is platform-wide and contains no store data. Patterns use syntax that means the same thing in Python re and ECMAScript, so the hub can hand them to new RegExp unchanged.
Request
Authorization
Bearer Token
Provide your bearer token in the
Authorization
header when making requests to protected resources.