​

Prerelease upgrade notes

​

rc.3 → 3.0

​

Breaking for rc.3 adopters

​

Media buy status migration

1. Status filters — Replace pending_activation with both pending_creatives and pending_start in status_filter arrays on get_media_buys and get_media_buy_delivery.
2. Status comparisons — Any if (status === 'pending_activation') needs to branch on which condition you’re checking. If you want “not yet serving,” check for both pending_creatives and pending_start. If you want “ready but waiting for flight date,” check only pending_start.
3. State machine transitions — rejected is now valid from both pending_creatives and pending_start (previously only from pending_activation). pending_creatives → pending_start happens when creatives are assigned via sync_creatives.
4. Legacy alias — pending continues to be accepted as an alias for pending_start in delivery response status filters.

​

Capabilities model simplification

{
  "features": {
    "content_standards": true,
    "audience_targeting": true
  },
  "trusted_match": {
    "supported": true,
    "uid_types": ["email_sha256"]
  }
}

{
  "content_standards": { ... },
  "audience_targeting": { ... },
  "trusted_match": {
    "uid_types": ["email_sha256"]
  }
}

​

preview_creative schema flattening

{
  "creative_manifest": { "format_id": { ... }, "assets": { ... } }
}

{
  "request_type": "single",
  "creative_manifest": { "format_id": { ... }, "assets": { ... } }
}

​

Governance lifecycle migration

{
  "media_buy_id": "mb_456",
  "planned_delivery": { ... }
}

{
  "governance_context": "campaign_2024_q4_nova",
  "purchase_type": "media_buy",
  "planned_delivery": { ... }
}

​

context and ext fields

​

Additive changes in 3.0

• RFC 9421 request signing profile (optional in 3.0, mandatory under AdCP Verified) — Ed25519 HTTP Message Signatures with canonicalized covered-component list. Published test vectors at static/compliance/source/test-vectors/request-signing/. sf-binary encoding and URL canonicalization pinned for bit-identical canonical inputs. 15-step verification checklist with keyid cap-before-crypto.
• Webhook signing unified on RFC 9421 — Baseline-required for sellers emitting webhooks. Sellers publish a signing JWK in their JWKS at jwks_uri; new signers use adcp_use: "request-signing" for webhook delivery, while deprecated webhook-signing keys remain accepted during the compatibility window. Use a distinct kid if you want webhook-only key material. 14-step webhook verifier checklist in the Security guide. HMAC-SHA256 remains a legacy fallback through 3.x (the entire authentication object is removed in 4.0).
• Required idempotency_key on every webhook payload — Sender-generated UUID v4 across all five webhook payload schemas. Replaces fragile (task_id, status, timestamp) dedup. revocation-notification.notification_id renamed to idempotency_key for protocol-wide consistency.
• check_governance on every spend-commit — Governance invocation is required at commit, not just at plan approval. Closes the loophole where partial spends could skip governance.
• Experimental status mechanism — status: experimental marker for fields and tasks in production use but not yet under full stability guarantees. custom pricing-model escape hatch on signals.
• submitted branch on create_media_buy — Seller has accepted the payload for processing but has not yet confirmed the order. Distinct from pending_creatives and pending_start.
• Time semantics + activate_signal idempotency — Unifies time-field semantics across the protocol. activate_signal added to the required-idempotency table.
• Known limitations + privacy-considerations reference pages — New /docs/reference/known-limitations and /docs/reference/privacy-considerations. Platform-agnostic lint prevents vendor-specific language from creeping into the spec.
• Signed JWS governance_context — Governance decisions are now cryptographically verifiable. Sellers resolve the governance agent’s JWKS via sync_governance and verify sub / aud / phase / exp before honoring the decision.
• Universal security storyboard — Every agent runs /compliance/{version}/universal/security.yaml (unauth rejection, API key, OAuth/RFC 9728, audience binding). Agents declaring signing also run the signed_requests harness.
• Cross-instance state persistence — Architecture spec requires persistent state (tasks, media buys, plans, signed artifacts, idempotency keys) across horizontally-scaled instances.
• Security implementation guide — New docs/building/by-layer/L1/security.mdx documents threat model, three-principal model (brand / operator / agent), and verification paths. Retires ambiguous “principal” terminology.
• GDPR Art 22 / EU AI Act Annex III as schema invariants — New registry policy eu_ai_act_annex_iii. requires_human_review on policies and categories. Schema-level enforcement of human_review_required: true for regulated verticals.
• Operating an Agent guide — New doc for publishers without engineering teams — three paths: partner, self-host, build.
• Release cadence policy — Named cadence: patch monthly, minor quarterly, major annual if needed. v2 EOL August 1, 2026.
• CHARTER.md — Formal governance charter published.
• Collection lists — Program-level brand safety using distribution identifiers (IMDb, Gracenote, EIDR) for cross-publisher matching. New targeting overlay fields (collection_list, collection_list_exclude). New genre taxonomy enum.
• Broadcast TV support — Ad-ID identifiers, broadcast spot formats (:15, :30, :60), Agency Estimate Number, measurement windows (Live, C3, C7), delivery data completeness (is_final, measurement_window).
• Offline reporting delivery — reporting_delivery_methods on capabilities, reporting_bucket on accounts, supports_offline_delivery on product reporting_capabilities. Avro and ORC added as file format options.
• TMPX exposure tracking — Country-partitioned identity and macro connectivity for the Trusted Match Protocol execution layer.
• TMP provider registration — provider-registration.json schema, GET /health endpoint, dual discovery models (static config and dynamic API), per-provider latency budget semantics.
• TMP multi-identity Identity Match — identity-match-request replaces single user_token + uid_type with an identities array (minItems 1, maxItems 3). Router filters per provider and re-signs with RFC 8785 JCS canonicalization; cache key adds consent_hash. Adds rampid_derived to the uid-type enum. Breaking relative to prior pre-release TMP drafts only; TMP remains pre-release in 3.0 and stabilizes in 3.1.0.
• GOVERNANCE_DENIED error — New correctable error code for governance-rejected operations.
• context/ext fields — Optional context and ext on all request/response schemas across governance, collection, property, SI, and content-standards protocols.
• Compliance testing capability — Agents include a compliance_testing: { scenarios: [...] } block in get_adcp_capabilities declaring which comply_test_controller scenarios they support. The block’s presence is the signal — compliance testing is NOT a supported_protocols value. Storyboard runners use the block to determine whether deterministic testing steps can be validated.
• Specialisms + compliance catalog — Storyboards ship in the protocol at /compliance/{version}/ (universal + protocols + specialisms + test-kits). New specialisms field on get_adcp_capabilities with 19 values across 6 protocols. Per-version protocol tarball at /protocol/{version}.tgz. See the Compliance Catalog.
• Structured measurement terms — measurement_terms on products and media buys for billing vendor, IVT threshold, and viewability floor negotiation. cancellation_policy on guaranteed products. viewability-standard enum. TERMS_REJECTED error code.
• Unified vendor pricing — pricing_options[] on list_creatives, build_creative, get_creative_features, and property-list. Shared vendor-pricing-option.json schema.
• Per-request version declaration — adcp_major_version on all v3 request schemas. VERSION_UNSUPPORTED error code. Multi-version sellers supporting v2 clients must detect v2 payloads by structural cues, not by this field (v2 schemas do not have it).
• Broadcast forecast schema — measurement_source, packages, and guaranteed_impressions on DeliveryForecast. New forecast-range-unit and forecastable-metric enums.
• Broadcast station identifiers — station_id and facility_id identifier types. linear_tv property type.
• Brand schema extensions — Generic agents array on brand.json. Visual tokens (border_radius, elevation, spacing, extended color roles). Structured font definitions.
• Per-item error schema — sync_creatives, sync_catalogs, and sync_event_sources response errors now use error.json ref.
• Property relationship field — relationship on brand.json property definitions (owned, direct, delegated, ad_network) for bilateral verification with adagents.json delegation types.
• sales agent type restored — sales restored to brand-agent-type enum. Sales agents (SSPs, publishers) are distinct from buying agents (DSPs, buyer platforms).
• Required tasks reference — New reference page consolidating required, conditional, and optional tasks across all AdCP protocols by agent role.
• Storyboard validation fixes — 20+ validation bugs fixed across 11 storyboard files: corrected field paths (creatives[0].action, media_buy_deliveries, renders[0].preview_url), added missing value: to field_value checks, added value property to storyboard validation schema.

​

rc.1 → rc.2

​

Potentially breaking for rc.1 adopters

​

Additive changes in rc.2

• Creative generation and preview — build_creative adds include_preview, preview_inputs, preview_quality, preview_output_format, quality, item_limit, and multi-format target_format_ids. Buyers can now preview inline, choose draft vs production generation, and request multiple output formats in one call.
• Creative library retrieval — build_creative also supports library retrieval using creative_id, optional concept_id, media_buy_id, package_id, and macro_values, so ad servers and creative platforms can resolve stored creatives into delivery-ready manifests.
• Creative capability discovery — Creative agents can declare supports_generation, supports_transformation, and has_creative_library. list_creatives now uses library-oriented fields like include_snapshot, has_served, and items.
• Product discovery and planning — get_products adds exclusivity, preferred_delivery_types, and time_budget, with incomplete in the response. Products may omit delivery_measurement, and packages can now carry per-package start_time / end_time.
• Compliance and governance — Creative disclosures add persistence semantics, and campaign governance introduces sync_plans, check_governance, report_plan_outcome, and get_plan_audit_logs.
• Accounts and sandbox ergonomics — sync_accounts adds payment_terms, and sandbox now participates in the natural account key for buyer-declared account references.

​

Need help?

• Community: Slack — best for quick questions from other implementers
• Issues: GitHub Issues — for bugs, spec questions, or migration edge cases
• Full v2 → v3 migration: Migration guide