---
title: "Ad tags & API card reference"
description: "Which tag tabs each placement type offers, the Settings controls (Domain, Protocol, Ad wrapper and its options, Fit container) with their REST names, and every default parameter type with how it travels on the wire — the companion to the Ad tags, invocation codes and the API guide."
type: "reference"
audience: [network-manager, publisher, admin]
keywords: [ad tags reference, tag types per placement type, Universal JS, Mount JS, Simple Iframe, Direct URL, VAST tags, Video Player, Email tab, API tab, Settings tab, serving domain, protocol, ad wrapper, friendly frame, sandboxed frame, no-redirect frame, fit container, default parameters, channel, custom parameter, partner sub-value, sub1, click tracking URL, GDPR macro, servingDomain, ajaxCodeProtocol, ajaxCodeAdWrapper, fitContainer]
ui_path: "Account → Publishers → site → zone → placement → Ad tags & API"
---

Fetch the complete documentation index at: https://epom.com/ad-server/docs/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Ad tags & API card reference

The companion to [Ad tags, invocation codes and the API](https://epom.com/ad-server/docs/guides/inventory/ad-tags-and-api.md), which has the
steps, the caveats and the fix-it checklist; this page holds which tabs each placement type
offers, the Settings controls and the default parameters. The API tab, the VAST tags and the
JavaScript API are on
[API tab, VAST tags and the JavaScript API](https://epom.com/ad-server/docs/guides/inventory/ad-tags-api-and-vast.md).

## Which tag types each placement type offers

| Tab | What it is | Site | Mobile site | Non-standard | Video | Email | Native | Application |
|---|---|---|---|---|---|---|---|---|
| Universal JS | Asynchronous JavaScript loader (an `<ins>` slot plus an async `<script>`) — the recommended default for web | ✔ | ✔ | ✔ | — | — | — | — |
| Mount JS | Bare JavaScript, no `<script>` tags: it creates the slot inside a container you pass in and loads the same loader — for single-page apps and late injection | ✔ | ✔ | ✔ | — | — | — | — |
| Simple Iframe | Plain iframe tag — maximum isolation, no page access | ✔ | — | — | — | — | — | — |
| Direct URL | The raw ad-serving URL — for systems that fetch markup themselves | ✔ | ✔ | ✔ | — | — | — | — |
| VAST tags | A VAST tag URL with a version picker (2.0–4.3, default 4.2), plus VPAID and VMAP tag URLs, for players | — | — | — | ✔ | — | — | — |
| Video Player | A ready-to-embed snippet with Epom's demo player and a sample video, pointed at the placement's VAST 4.0 tag | — | — | — | ✔ | — | — | — |
| Email | Email-safe image + click URL pair and the Creative / Landing page URLs | — | — | — | — | ✔ | — | — |
| API | Request-URL documentation with parameters and sample responses | ✔ | ✔ | ✔ | — | — | ✔ | ✔ |

Every ✔ except **VAST tags**, **Video Player** and **Email** is also gated by its own per-tag-type
permission. The full matrix and per-type markup samples are in the
[invocation codes reference](https://epom.com/ad-server/docs/reference/invocation-codes.md).

## The Settings controls

Over the API they are `servingDomain`, `ajaxCodeProtocol`, `ajaxCodeAdWrapper` and
`fitContainer` on the placement's `placements/update/*` operation.

| Control | Shown on | What it does |
|---|---|---|
| **Domain** | every type, when the network has at least one tag domain and your role holds *Set Ad-Serving Domain (Placement)* | The ad-serving domain, the default one first. One domain per placement drives every URL it produces: the JS tags, Simple Iframe + Direct URL, the API request URL and the video / email URLs (VAST / VMAP tags, the email creative + landing URLs). `GET /rest-api/placements/{placementId}/serving-domains.do` lists the values it accepts. |
| **Protocol** | every type | **Relative** (`//`, the tag takes the page's own scheme), **HTTPS** or **HTTP**. Same reach as Domain. |
| **Ad wrapper** | Site, Mobile Site, Non-standard (JS tags only) | How the ad server hands the creative to the page. Not written into the tag: attached to every response. Options below. |
| **Fit container** | Mobile Site, Non-standard | Scales the ad to its container. Sent with every ad response, not written into the tag. |

| Ad wrapper option | What the page gets |
|---|---|
| Without Wrapper | The creative markup is written straight into the page, next to the slot |
| Friendly Frame | The creative runs inside a same-origin iframe the loader creates |
| Sandboxed Frame | The same iframe with a `sandbox` attribute that allows scripts, forms, popups, modals and top-level navigation |
| No-redirect Frame | The same, except top-level navigation is allowed only on a user click, so a creative cannot redirect the page by itself |

The exact sandbox flags of the last two can be overridden for your network by Epom (a
server-side setting).

## Default parameters

Appended to *every* tag, URL and VAST/VMAP tag generated for this placement, and to the API
request URL. JS tags carry them as `data-*` attributes on the slot; URL-shaped codes append them
to the query string.

| Parameter type | Value | On the wire | Notes |
|---|---|---|---|
| **Channel** | a traffic channel | `ch` on a URL | Adding it again replaces it. |
| **Custom Parameter** | a **Key** + **Value** pair | `cp.<key>` on a URL | Repeatable — the same key can be added more than once. |
| **Partner Sub-value** | **Key** from a pick-list of `sub1` … `sub10` + a value, normally the partner's macro | bare `&sub1=…`, not `&cp.sub1=…`; a JS tag writes `data-sub1` … `data-sub10` and the Universal JS loader forwards each under its bare name | The name a partner arriving from Everflow, TUNE or Affise already sends, and the name the ad server stores with the click so it survives to the conversion. Over the API anything outside the ten is a `400`. |
| **3rd Party Click Tracking Url** | a click-tracking URL | `click` on a URL, always last in the query string | Adding it again replaces it. |
| **GDPR Applies**, **IAB TCF Consent String**, **App Bundle**, **Advertising ID (IFA)**; under **Advanced**: **User ID**, **Transaction ID**, **Page Domain**, **Page URL**, **Ad-Loaded Handler** | usually an upstream macro, emitted verbatim | forwarded as received | Four of the nine suggest a macro: GDPR Applies hints `${GDPR}`, IAB TCF Consent String `${GDPR_CONSENT_849}`, Page Domain / Page URL Google Ad Manager's `%%SITE%%` / `%%REFERRER_URL_ESC%%` (other players' macros: [Passing the page from a player or ad server](https://epom.com/ad-server/docs/reference/invocation-codes.md#passing-the-page-from-a-player-or-ad-server)); the other five show a generic *Default value* placeholder. **User ID** is tag-only (a JS slot attribute) and **Ad-Loaded Handler** is a JavaScript handler that runs in the page — neither is appended to a URL. |

## Related

- [Ad tags, invocation codes and the API](https://epom.com/ad-server/docs/guides/inventory/ad-tags-and-api.md)
- [API tab, VAST tags and the JavaScript API](https://epom.com/ad-server/docs/guides/inventory/ad-tags-api-and-vast.md)
- [Copy and preview an ad tag](https://epom.com/ad-server/docs/guides/inventory/ad-tags-preview.md)
- [Ad tag FAQ](https://epom.com/ad-server/docs/guides/inventory/ad-tags-faq.md)
- [Invocation codes reference](https://epom.com/ad-server/docs/reference/invocation-codes.md)
- [Target on custom parameters passed in the ad tag](https://epom.com/ad-server/docs/guides/targeting/custom-parameter-targeting.md)