[dhruv8sh]

Summary

• Investigates whether Lockr can issue or refresh IDs server-to-server, so a visitor whose browser blocks the Lockr SDK still gets an ID. No such API could be confirmed. Lockr's own backend calls ID partners server to server. The only readable token API is the browser call Prebid's lockrAIMId module makes, which takes a raw email. Lockr's linked API reference returns 404, and its OpenAPI file is not archived.
• Writes no provider spec. Lists precise questions for Lockr's account team and recommends a fallback: native ID5 for id5-sync.com now, and LiveRamp ATS and UID2 once hashed-email intake lands.
• Proposes three additive changes for framework revision 13. It does not edit the framework spec.

Changes

File	Change
docs/superpowers/specs/2026-10-23-lockr-server-side-api-findings.md	New. Sourced facts, questions for Lockr, fallback and ownership, rollout note, proposed framework changes, open questions, decisions

Closes

Part of #1246

Spec

Spec: docs/superpowers/specs/2026-10-23-lockr-server-side-api-findings.md. It is an investigation under the framework spec in #1428 (revision 12), not a feature.

Assumed facts

• Lockr has no IAB GVL ID. The framework states it, but gives no source.
• Lockr checks Origin against the publisher's registered domains. This is inferred from the origin_override doc comment at integrations/lockr.rs:68-73.
• A native ID5 provider needs its own ID5 contract when a publisher gets ID5 through Lockr today.
• sync-no-hem-ids issues IDs without a hashed email. This is inferred from its name only.

Questions for Lockr (full list in section 5)

• Is there a server-to-server issue or refresh API? What are its endpoints, version and current reference? Is v1 generate-tokens supported from a server?
• How does it authenticate (API key, secret, signature, IP allowlist, appID alone)? Is Origin checked?
• Which inputs issue an ID without an email (IP, UA, page URL, LTID)? Does it accept a SHA-256 hashed email? How is the end user's IP passed?
• What is the response shape? Are ids.<key>.eid guaranteed? Do v2 responses carry lockrMappingToken? What do no match, opted out and token invalid look like?
• What are the token lifetimes, the refresh method and how long a token stays refreshable? Is there a refresh hint?
• What are the rate limits per appID, IP and LTID, and how is throttling signalled?
• Which consent signals are required, and is DBAA treated as no restriction? Does Lockr have a GVL ID? Is GDPR traffic supported?
• What does a 2xx revoke-consent mean, Lockr's own opt-out or a global withdrawal? How does a server learn of a revocation?
• Is server use covered by the AIM contract? Is there a test appID or sandbox? Will the API stay stable after the 2025 acquisition?

Decisions to confirm (section 10)

• D1: no Lockr resolver until Lockr confirms an API in writing.
• D2: TS never sends a raw email to any provider.
• D3: TS never replays the SDK's v2 endpoints without the SDK.
• D4: native ID5 owns id5-sync.com, Lockr is narrowed away from it, and the change in bidder-visible ID5 UID is accepted.
• D5: Lockr keeps liveramp.com and uidapi.com until hashed-email intake lands.
• D6 to D8: the framework changes below.

Proposed framework changes (section 8)

1. [ec.identity.providers.<id>] enabled, default true, so the Lockr proxy can run when native providers own every Lockr source. Today, narrowing Lockr to no source fails validation.
2. The Pluggable, competition-neutral modules with a technical permission model #777 identity type runs several modules (modules). It runs one module today (configuration-rules.md:58 on feature/7-integration-seam-impl).
3. Conditional on a confirmed API: resolve_enabled, default false, for a provider that both captures and resolves.

Test plan

• Other: docs only. prettier --config docs/.prettierrc --check passes on the new file (Node 24.12.0). Every file:line reference was checked against c84a73da7 and Prebid.js 10.26.0.

Checklist

• Feature PRs: spec linked above, ending in a review log of two or more agent review rounds
• Changes follow AGENTS.md conventions
• No secrets or credentials committed