Release 153

Release 153 is the AI assistant release. Network managers get an AI assistant tab: a chat in which you run your account in plain language — “pull yesterday’s revenue by campaign”, “make a 300×250 banner from this image and link it everywhere it fits”, “why isn’t this placement filling?” — and it does the work as you, with exactly your permissions. It is free to try during a launch promo. Alongside it, anything deleted by mistake can now be brought back, heavy creatives are flagged and CDN traffic is measured per zone, video requirement presets become editable, header-bidding tags can be managed over the API, and a long list of delivery, auction and permission fixes lands.

Things to act on.

The AI assistant is on for Network Manager–type roles from day one — every account role that views all campaigns and all inventory gets the new AI Assistant Chat permission; other roles do not. Administrators can switch it on or off per role in Admin → Users & Access → User Roles & Permissions.

On the platform’s key, the assistant is billed to your network after the promo. Usage is free for one month from the day your network is upgraded to this release, up to $20 for the whole network, and each user is capped at $20 a month unless an administrator sets another limit. To avoid platform billing, add your network’s own Anthropic key or let users add theirs — see Which key it runs on.

Billing plans are now changed by Epom support only. The Ad Server Fees page still shows your plan and the billing statistics, but no longer saves or activates a plan or recalculates charges; ask Epom support or your account manager for those.

Rotate your REST API keys again if you rotated them in the new interface. Until this release Regenerate keys reported success without changing the stored pair. If you rotated a key because it leaked, rotate it again now.

Check your fraud validation settings. Saving Validation settings in the new interface switched click and impression fraud validation off. If your network saved that page before this release, check both settings and switch them back on if needed.

Tell your DSP partners about ${AUCTION_MBR}. It is now clearance price ÷ bid, as OpenRTB 2.5 defines it; it used to be the reverse. A partner that inverted it must stop.

Raw event export to your own SFTP server: allow renaming. Each file is now uploaded under a temporary hidden name (.<file>.<id>.part) and renamed into place, so nobody reads a half-written file. Give the SFTP user permission to rename files in the export folders (where the server refuses, files are written directly under their final names, as before), and whatever reads the folders should skip names that start with a dot. See Raw event files in your own storage.

Some figures change after the upgrade.

• Third-party tracking codes saved on HTML Code creatives start firing — if you also pasted the same tag into the creative’s code as a workaround, remove that copy or it fires twice.
• Publisher-side conversions rise where URL piggybacks with different Fire for and Sampling settings are mixed.
• Where an entity has two Set price-adjustment rules on the same condition, the most recently created one now sets the price.
• Delivery resumes for campaigns held back by one renamed or merged city in a location rule, for entities held back only by a targeting rule on a preset group that no longer exists, and for entities whose Match / Not Match rules on types other than Channel failed every request (those rules now act as Include / Exclude).
• Block rules are always enforced, also when an entity combines rule types with OR; and in a Campaign-type daisy chain without Apply priorities, House ads now serve only when nothing else does.
• Second-price auctions no longer end without a winner when the runner-up bid sits under the winner’s floor — clearing prices change. App traffic now reaches DSP partners when inventory masking or publisher-field hashing is on.
• More requests match App Package targeting.
• Vpaid opportunities stop reading 0 on Advanced reports; Conv. fraud fills in every General-report grouping.
• Top Domain fills on video impressions and clicks, and the referer and origin macros now name the page — see Top Domain names the page.
• Ad-server fees: traffic is read from every CDN zone your network serves through (a network served only through its own clients’ CDNs is billed no traffic), and header-bidding slots filled by other demand now count, by default as impressions at your plan’s prices. A Google Ad Manager line item that serves one of your own Universal JS or Mount JS tags counts once — as the impression the tag serves, not again as a header-bidding fill; Simple Iframe and Direct URL tags in Ad Manager are still counted twice, so use the first two there. See Header bidding with Google Ad Manager.
• Bids from DSP partners that bid in their own currency are held against the floor in US dollars, so a bid over the floor is no longer refused and one under it no longer wins.
• A header-bidding slot whose auction ends before Google’s gpt.js has loaded now goes to Google Ad Manager instead of rendering our winning bid directly, so our bid can lose to your line items there; a gpt.js that is slow but has not failed can hold such a slot up to 3 seconds. See Header-bidding slots reach Google Ad Manager when the auction ends first.

New features

An AI assistant built into the console

Open Account → AI assistant and ask. The assistant finds, creates and edits advertisers, campaigns, creatives, sites, zones and placements, sets targeting, capping and limits, links banners, gives ad tags and runs reports — the same tools as the MCP connector from release 152, so it can do nothing you could not do in the console. Each tool it runs shows as a step you can open, entities it creates or finds come back as links, and before a delete, a change to several entities at once, or a budget, price, bid or payout change it lists what it is about to do and waits for your yes. Every change lands in the action log under your name, marked as made through the assistant.

Attach images, video, HTML5 ZIPs, PDFs, CSV or text (up to 50 MB each) and say “create a banner from this” — the creative always stores its own copy of the file. Each chat runs on Fast (the default), Balanced (4× the price) or Deep (8×); every reply shows its cost, and the assistant suggests a stronger or a cheaper model with a one-click button when it would help. It answers in the language you write in. See Work with the AI assistant and, for how to ask and example prompts, Get the most out of the AI assistant.

Your own Anthropic key, your network’s, or the platform’s

The assistant runs on the first key that exists: your own (a new Preferences → AI assistant card), else your network’s (a new AI (Anthropic API key) section in Admin → White label → API keys), else the platform’s, when your network’s billing plan offers it. Your own and the network’s key are paid to Anthropic directly and the platform bills nothing for them; the platform’s key is billed on your network’s Epom invoice. Keys are checked with Anthropic before they are saved, stored encrypted and never shown again — only their last four characters. With no key at all, the assistant page explains the three ways to get one. Ask in analytics and the traffic-quality AI analysis are unchanged and not billed. See Which key it runs on.

Free to try: the launch promo

Usage on the platform’s key costs your network $0 until the last day of its promo — for every existing network, one month from the day it is upgraded to this release — up to a shared $20 allowance for the whole network. Each user’s monthly limit still applies, the spend meter says Included in your plan until that date with what is left, and when the promo is over a note in the assistant explains the options: keep using it billed, add your own key, or use your own Claude through MCP. The promo is set per billing plan, so a new network gets one when its plan does. See The promo month.

See your AI spend and cap your own key

Preferences → AI assistant shows which key you run on, what you spent this month, and the limit that applies with who set it. On your own key you can set your own monthly cap there; on the network’s or the platform’s key, the limits your administrator sets apply — per user on the user’s edit form, or a network-wide default that Epom support sets on request. Administrators see every user’s usage in Admin → Billing & Fees → Ad Server Fees → AI assistant usage. See Preferences and Set monthly limits.

Restore what was deleted by accident

An advertiser, campaign, banner, site, zone or placement deleted in the last 90 days can be brought back — from the new Recently deleted page on the advertiser and publisher tree, from Undo in the message right after a delete, over the REST API, or by asking the AI assistant. A restore puts back what the delete took down: the on/off state, banner–placement links, targeting and everything deleted along with it. Deletions made before this release cannot be restored this way. See Restore something you deleted.

Ready-made formats from Epom’s template library

Ask the assistant for a format your account lacks — “a catfish with this image” — and it describes the template, adds it from Epom’s template library after you agree, builds the creative on it and links it. It never adds the same template twice. Adding a template from the library needs permission to create templates and to view all templates. The assistant can also read and change a template creative’s settings — a video overlay’s Parent Selector, a catfish’s position or close button. See Templates.

Report a bug or ask for a feature from the chat

Tell the assistant something looks broken, is missing or is awkward, and it can file a bug report, feature request or improvement with the product team — or a support request for what only support can switch on for your network (a module, an RTB endpoint, a serving domain). It first checks whether a setting explains the problem, shows you a short draft, and files it only after your yes. See Report a bug or ask for a feature.

The assistant traces a creative on live traffic

When nothing seems to be in the way but a creative still serves less than expected, the assistant offers a serving trace: for 1–15 minutes (10 by default) the ad servers note every ad selection on the creative’s placements, and the assistant then tells you how often it served, how often it was left out and why (capping, limits, targeting, daisy chaining, video requirements…), and which creatives won instead. It asks before starting, and only you can read your trace.

Clean up stale location targeting

Now and then the geo database renames a place or merges it into a neighbour (“Lexington-Fayette” is now “Lexington”), and a location rule that names such a place matches no visitor. A new page, Stale locations — the crossed-out map pin on the Advertisers and Publishers action rail, or Clean up stale places across the account under a red place on a targeting card — lists every such rule on the advertisers, campaigns, banners, sites, zones and placements you manage, and says what removing each one would change: Safe to remove (it is already ignored), Opens to all locations or Starts delivery. The safe ones come pre-selected, so you can remove them in one pass, and Replace… swaps a stale place for the name it has now. While the geo service cannot be reached, the page says so instead of listing anything. Saving a location rule on a targeting card now also refuses an unknown region or city, so new stale rules stop appearing. The REST API and the AI assistant can do the same cleanup. See Clean up stale location targeting.

Heavy creatives are flagged

Every creative is now weighed: the bytes one impression downloads, file by file. A banner heavier than recommended shows a Heavy creative button beside Preview with its weight; click it for the recommendation and the files that make it up. The recommendation follows the IAB New Ad Portfolio for the creative’s size (300×250: 300 KB), with your network’s own limits for other sizes and for video in Admin → System Preferences. Ask the assistant “which of my creatives are heaviest?”, or use the creative weights API. See Creative ad specs.

See where your CDN traffic goes

A new admin page, Billing & Fees → CDN Usage, shows the traffic each CDN zone reported for a period next to an estimate per advertiser, campaign and creative, and lists the heavy creatives that actually serve, sorted by the traffic they cause. Roles with access to Ad Server Fees get it. See Finances, fees and referral billing.

Edit video requirement presets

The publisher video specs (Hulu, Netflix and others) can now be edited, duplicated, deleted and marked inactive on Admin → Creatives & tags → Video requirement presets, and Apply to N sites pushes an edited preset to every site that was filled from it. Sites keep their own copy until you apply again, and a site that no longer matches its preset says so. Also over the REST API.

A better editor for Advanced video files

An Advanced Local Video banner’s video files are listed in the order the player gets them, each with its resolution, bitrate, duration and size and a player. Add several at once — upload, links or the media library. Companions show as previews. A banner without any video file no longer serves, and compression never scales a video up or re-encodes an MP4 that already fits.

Header-bidding tags over the API and from the assistant

Header-bidding tags can now be listed, created, changed and deleted over the REST API, and the assistant can set up or change a whole tag in one go — slots, ad units, bidders — and tell you how it differs from the site’s other tags. See Header bidding.

Header bidding without consent can skip Google Ad Manager

A new tag setting, Call Google Ad Manager without consent, is on by default, so nothing changes. Switch it off and, where GDPR applies and the visitor did not consent, the tag skips Google Ad Manager — which counts those requests against your match rate — and picks the winner itself. Your consent tool must load before the tag.

Re-apply auto-linking after a category or label change

When a site moves to another category or a placement’s labels change, the creatives linked for the old values no longer stay behind. Check auto-linking on the site, placement, campaign and banner pages (run on its own after a save that changes categories or labels) shows how many links to add and remove, and Apply auto-linking brings them in line with the rules; the API has the same operation. Creatives linked by hand are never unlinked. Publishers need the new Apply auto-linking to own inventory permission, which the network turns on. See Re-applying auto-linking.

Catch duplicate and expired impressions and clicks

The same impression or click arriving twice for one ad request, and click links older than their lifetime, can now be caught. Under Validation settings, three checks — impression deduplication, click deduplication and click signature check — each run Monitor (counted, but labelled, so you see the size of the problem first) or Enforce (kept out of statistics, limits and billing; the visitor still sees the ad or reaches the landing page). All three are off until you choose otherwise, and the time windows they use — how old an impression beacon or a click link may be — can be changed on the same page. The older checks — impression signature check, impressions validation, clicks validation, IP blacklist check and the three conversion checks — get the same Off / Monitor / Enforce choice, so you can see what each would remove before it removes anything; your current settings carry over unchanged. Video impressions get their own Video impressions: suspected-IP check, off by default: CTV, server-side ad insertion and mobile carriers send many viewers’ impressions from one address, so a video impression keeps counting on its signature and age alone until you choose Monitor or Enforce. Video impressions are still accepted for up to 5 hours after the VAST response, now an editable window. The page is now grouped by Impressions, Clicks, Conversions and All events, with each setting explained behind an ⓘ. The Advanced report gains Duplicate impressions, Expired impressions, Duplicate clicks and Expired clicks, and a Rejection Reason grouping and filter that splits rejected events by why they were refused. See Moderation & quality and Invalid traffic.

Campaign and creative weights on each placement

One publisher’s tag can now split its traffic between campaigns, and between a campaign’s creatives, differently from every other tag: Summer 3 against Fall 1 on one publisher, the same creatives 50/50 there and 20/80 elsewhere. The weights sit on the Linked banners card of a placement and the Linked placements card of a banner — on the campaign and banner rows of the tree, or in two columns of the grid — and a placement without its own value keeps the campaign and banner weights. The columns appear once an administrator grants the new Manage Weights on Placements permission (off for every role; read-only shows them without editing). The Banners probability card shows and edits them next to the share they produce; the REST API and the AI assistant read and set them too. See Weights on one placement.

Improvements

The assistant diagnoses delivery and reports

• Why isn’t it serving now also finds a level switched off by a reached Total limit, an expired end date, a full placement or site limit, links switched off, a creative’s own dates, which part of a type or size mismatch fails, and device targeting no visitor can pass on both sides. See Why is my ad not serving?
• Why is my report empty names the first reason a report comes back empty — future dates, a missing permission, data older than it is kept, a filtered entity that did not exist yet, filters that contradict each other — and otherwise finds the filter that leaves nothing. See My report is empty.
• Why did it drop compares two periods and names the country, creative, placement, device or hour that moved most; low fill explains a placement’s requests vs impressions by creative.
• What does this link return checks a media file, click URL, pixel, VAST tag or page from the ad server’s network: status, redirects, a VAST summary, and the video player’s CSS selector on a page. It runs no JavaScript and comes from a datacenter, so a geo- or device-targeted tag may answer differently than for a real visitor.
• Raw event logs: questions about single clicks, impressions and conversions — clicks without impressions, repeated IPs, where clicks come from — over up to 3 days, with the log reports’ permissions. See Ask the assistant to analyse the raw logs.
• Advanced reports — region and city, referrer, custom parameter, device, connection — with the same permissions as the console.
• Product questions are answered from this help center, extended with the questions clients ask support most often.

Each publisher gets the video files its spec accepts

An Advanced Local Video banner with several renditions used to be judged by its best file alone: every publisher received all of its files, including those its video spec refuses, and a creative whose best file missed a publisher’s spec was not served there even when a smaller file met it. Now the creative is served on a site when at least one rendition meets that site’s spec, and the site receives only the renditions that do, best first — so a stitcher transcodes from the best file its publisher accepts. The Video files card names, for each file, the sites it is served on and those it is not, and warns when a linked site accepts none of them. A publisher spec applied over the API to a site that had none is now switched on with it. See Video files and Check video creatives against a publisher’s spec.

Header-bidding slots no longer wait for slow programmatic partners

On a header-bidding slot, the programmatic partners asked for the impression are no longer waited for past the time the page gave the auction: the timeout sent to each partner and the wait for its answer are cut to what is left of the slot’s budget, so a slow partner is skipped or counted as a timeout instead of holding the slot back. Ordinary ad requests keep each partner’s full Timeout. See Configure DSP partners.

Header-bidding slots reach Google Ad Manager when the auction ends first

On a page with no consent banner the header-bidding auction starts at once and often ends before Google’s gpt.js has loaded. A slot with an ad unit path used to be rendered directly then — our winning bid, or with no bid its fallback code or a collapse — and Ad Manager was never asked. Such a slot now waits for gpt.js and, once it has loaded, goes to Ad Manager with our bid as key-value targeting, so our winning bid can now lose to your Ad Manager line items on those rounds. A slot waits only if it would go to Ad Manager, and only while gpt.js is still loading. A slot that goes direct anyway never waits: our own sold creative under Serve our demand first, every slot of a visitor who declined consent while Call Google Ad Manager without consent is off, video slots and slots without an ad unit path are served at once, and in a round that has both only the slots bound for Ad Manager wait. If gpt.js fails to load — an ad blocker dropped it — the slot is served without Google at once; if it neither loads nor fails, the slot waits at most 3 seconds after the auction and is then served directly. See Header bidding with Google Ad Manager.

Tracking pixels and piggybacks: edit in place, long values in full

Third-party pixels on the VAST tracking card of a video banner or placement can now be changed in place — click the URL or its Fires on value — instead of being deleted and added again. Long URLs and code in the tracking tables (pixels, piggybacks, server-side trackers, tracking URLs, content replacement) are shown in full, over as many lines as they need, instead of being cut off. A JS piggyback’s code is shown as code and edited in a code editor that keeps its line breaks. See Piggyback pixels and Video banners.

Video campaigns: playback events are no longer conversions in limits and capping

VAST playback events (start, quartiles, viewability, player interactions) used to count as conversions in a campaign’s, banner’s, advertiser’s, site’s or placement’s Conversions limit, reset the CPA Auto Deactivation counters and trigger Action capping. They no longer do: those now see only real conversions, so a conversion cap on a video campaign is no longer filled by playback, and CPA Auto Deactivation can finally stop a video campaign that does not convert. The events are still billed and still count toward budget (revenue) limits, and a per-action limit set on an event’s action — say, 10,000 viewable impressions — still counts that event. Counters that playback already inflated are left as they are; reset one with its eraser if a campaign stopped early.

The Banners probability card matches ad serving

A placement’s Banners probability card now opens on As served (highest priority only): the shares are split inside the top priority tier that still has a competing campaign, as the ad server does, and lower-tier campaigns show as NA. An advertiser or campaign blocked on the placement or its site, and a banner that reached its limit, show as NA rather than disappearing; shares add up to 100 % even when no campaign has a weight. Ignore Priority is still offered, and the card is hidden on daisy-chained placements. See Optimize ad rotation.

Deleting a preset group or a template that is in use asks first

Deleting a preset domain, IP-range or app-package group that live targeting still uses, or a banner template that live banners or placements still use, now stops and tells you what uses it — for a group, that its targeting rules are removed with it; for a template, that banners lose their markup and placements their native rendering. Confirm to delete anyway; cancel and nothing changes. See Preset groups and Create and manage banner templates.

Serving checks count matching rules and linking switches

Why isn’t it serving no longer reports a banner and placement that a Matching rule brings together as “not linked” — it says they are linked through a rule. The Serving pill counts a link only while the other side is on and has its linking switch on, so a banner whose placements all have links switched off no longer reads Serving. See Serving state.

A parent’s block shows on the child as inherited

A campaign’s blocks shown on its banners, and a site’s blocks shown on its placements, are marked (inherited from the campaign) / (inherited from the site) and cannot be removed there — change them on the campaign or site. See Block demand and inventory.

Changing a banner’s type asks first

Saving an existing banner under another type deletes the creative files, code and template values of the old type; the form now asks you to confirm before it does.

Switching off a delivery card asks first

Switching off Frequency capping, Limits, Per-action limits, Pricing, Revenue share (on a site or a placement), CPM threshold, Daisy chaining or Tracking codes deletes the card’s settings — it is not a pause. It now asks you to confirm first.

See the graph and the report together

An executed analytics report’s view switch has a third state, Graph and report, which shows the graph above the detail grid, so you no longer flip between the two. Your choice is remembered for the next report.

Large networks: faster banner pages and link saves

On networks with thousands of sites, a banner’s page opens in a fraction of a second, and a linking panel with more than 10,000 entries opens as a paged list (Show as tree anyway is one click away). Saving links no longer fails when someone linked the same placement meanwhile, and placements that were skipped are counted in the message. Saving a large selection is about three times faster (linking a creative to 29,000 placements: 17 s instead of 57 s), and the links you just saved stay ticked while the tree reloads.

Delete dialogs say a delete can be undone

Delete confirmations name what goes with the entity and say it can be restored within 90 days; after a delete the message links to Recently deleted.

Moderators choose the rejection e-mail

Rejecting a banner or site in the new interface asks which rejection e-mail to send, or none. A site rejection used to mail nobody, and a banner rejection mailed every template.

Smaller improvements

• The white-label Default theme and Default density now apply to users who never picked their own.
• The stock Publisher and Advertiser roles can change their own password and edit their personal details and interface preferences. Mobile Carrier grouping has its own report permission, on for every role.
• Connection Type targeting can include or exclude “Unknown”.
• A publisher with view-only access to a site can switch, add, edit and delete the piggybacks of that site and of its placements; the rest of those pages stays read-only. See Piggyback pixels.
• The action log keeps the history of deleted users, under their username.
• Delivery inputs (price adjustments, capping, CPM threshold, per-action limits) stop at the values the server accepts, and limits must rise from daily to total.
• Conv. fraud in the General report is filled in every grouping, not only by Action.
• Location rules show a renamed or merged place as a red chip, and the serving check names it.
• On wide screens, switched-off feature cards leave the page while the Features rail, which carries their switches, is shown.
• Header-bidding adapter parameters now include your network id.
• Users who have the AI assistant also get API Key Access, so they can connect an AI client over MCP; Preferences shows the API key shortened, with Copy for the full key.
• Location targeting keeps serving through a short geo-service outage: a place already found is dropped only after three failed look-ups in a row.
• While the geo service cannot be reached, a targeting card shows the places it could not check as saved, with a note, instead of marking them all red, and the Mobile carrier picker says the carriers could not be loaded instead of listing none. A real region or city is no longer refused as unknown because one look-up timed out.
• CDN Usage: Creatives by weight exports to CSV, and a template or native creative that plays a video is measured against the video limit instead of the banner-size one.
• The role permission editor speaks your interface language: permission names and the grant options (None, All, Shared, Enabled…) are translated instead of showing raw constants such as ENABLED, and the Admin UI checkboxes read like the sidebar entries of their pages. About twenty more option lists that showed raw or English names are translated too, among them the DSP creative-scan statuses, the third-party tag options and the banner and placement grids’ type column.

The placement Refresh interval is gone

The Refresh interval (sec) field no longer appears on application and native placements: it only served the discontinued Epom mobile SDK. Refresh after (sec) on site placements is a different setting and is unchanged.

Top Domain names the page on video impressions and clicks

Every impression and click URL now carries the page the ad request named, VAST <Impression> and <ClickThrough>, API, native and DSP clicks included, so Top Domain on those events is the page rather than empty or the player’s frame. Top Domain is now https://host in lower case, and values that name no page — null, file://, Google’s IMA SDK and ad frames, your own serving and CDN hosts — are skipped. In Firefox the loader now reports the page around a cross-origin ad frame instead of the frame. Two new Advanced tag parameters, Page Domain and Page URL, let a player or ad server pass the page with its own macro (GAM %%SITE%% / %%REFERRER_URL_ESC%%). The Impressions, Clicks, Conversions and Actions Logs gain a Top Domain column. See Passing the page from a player or ad server and Why is my Top Domain breakdown empty?.

Page macros: $$PAGE_URL$$, $$PAGE_DOMAIN$$, $$PAGE_ORIGIN$$

Three new macros name the page the ad is shown on: $$PAGE_URL$$ (and _ESC), $$PAGE_DOMAIN$$ (the bare host, no scheme or port) and $$PAGE_ORIGIN$$ (and _ESC). They skip every source that is not the page — a Google IMA or ad frame, your own serving or CDN host — so under a video player $$PAGE_DOMAIN$$ is the publisher’s domain or empty, never imasdk.googleapis.com; with only the page origin known, $$PAGE_URL$$ is that origin plus /. The JS loader now sends the top page’s address when it can read it, and nothing from inside a frame of another site, instead of the frame’s own address. $$REFERER$$, $$REFERER_ESC$$, $$REFERER_DOMAIN$$, $$ORIGIN$$ and $$ORIGIN_ESC$$ keep working as aliases and now resolve like the new names — existing tags and landing URLs need no change; the console’s macros list offers only the new names. The three REFERER names still pass through a page a server-to-server partner names by its bare domain (news.example/sport, no scheme). See Macros.

Referer in reports becomes Top Domain

The Advanced report’s Referer grouping is no longer offered: on impressions and clicks it named whatever frame, player or CDN called the ad server — often the ad server itself — not the page. Top Domain is the page. The domain text filter now matches Top Domain and is labelled so. The REST API, MCP and saved or scheduled reports keep accepting groupBy=REFERER and hadoopRefDomain with no change on your side: they now return Top Domain values, still under the column name referer, and a saved report grouped by Referer opens grouped by Top Domain. The Domain column of the Impressions, Clicks, Conversions and Actions Logs is unchanged. See Why is my Top Domain breakdown empty?.

REST API changes you may notice

• An API key now needs API Key Access on its role for the analytics report (/rest-api/analytics/{format}) and the MCP endpoint (/mcp) too, as on every other REST call. A key issued before the permission was switched off answers 403 there. If an integration stops, switch API Key Access on for its role.
• A site’s CPM threshold (/rest-api/sites/{siteId}/cpm-thresholds, its delete, and the console card) now needs Manage Publisher CPM Threshold to change — read-only is enough to read it. The permission used to only hide the card; no stock role holds it, so an integration that sets thresholds answers 403 until your network administrator switches it on for its role.
• Grouping or filtering an analytics report by Referer or Top Domain over the REST API now needs the Referer / Top Domain report permissions, as the console always did; without them the call answers 403.
• A JSON analytics report no longer repeats a field name. Where several columns share a display name (the Base, Publisher and Advertiser Impressions, Clicks, CTR…), the last keeps the name — the value parsers already read — and each earlier one is now named by its column id (publisher_impressions), so its figure is no longer lost. Add jsonKeys=id to name every field by column id, the same in every language. See JSON output.
• The analytics report parameter epomThirdPartyReportingAnalyticsType is gone, and saved reports and dashboard widgets no longer list it. A request that still sends it is answered as if it were absent — with every column the report normally returns — and a saved report or widget stored with it opens and runs as before.
• The placement default tag parameters (/rest-api/placements/default-invocation-param-types and the add / remove operations) take two more types, PAGE_DOMAIN and PAGE_URL.
• GET /rest-api/serving-check reports a deleted creative, campaign, advertiser, placement, zone or site as a blocker instead of answering 404 (404 remains for an id that does not exist).
• Placement refreshInterval is retired: placement reads no longer carry it, a create or update that still sends it succeeds with the value ignored, and ad responses drop REFRESH_INTERVAL (app API) and refreshInterval (native JSON).
• Deleting a preset domain, IP-range or app-package group that targeting rules of live entities still use answers 409 with the entities under usages; add force=true to delete the group together with those rules. Deleting a template that live banners or placements use answers 409 the same way; force=true deletes it and reports what was detached. See Targeting rules via API.
• Blocking an advertiser on a placement (POST /rest-api/placement/{placementId}/targeting/advertiser/create) accepts only the EXCLUDE rule; anything else answers 400.
• A mobile-carrier rule naming an unknown carrier is refused with the names; while the carrier list is unavailable the call answers 503 — retry later. The carrier list itself (/rest-api/targeting/mobile-carrier/bycountry/values) and the region and city lists (…/targeting/country/region/values, …/country/region/city/values) answer 503 during a geo-service outage too, instead of an empty list that reads as “none”.
• Creating a location rule (…/targeting/location/create on any level) answers 503 while the geo service is down instead of 400 unknown region name, names an unknown country, region or city in your language, and stores a place whose name holds a comma as one part, as the console does.
• Preset domain and app-package uploads count case variants of entries already present as duplicates instead of refusing the whole file.
• The API reference now lists the authentication each operation accepts (signed request, API key, Bearer token, console session) and documents the referral-program and Network Finances operations.
• GET /rest-api/sites/{siteId}/cpm-thresholds needs view access to the site; another publisher’s site answers 403.
• Reading a site’s or placement’s bid floor (GET /rest-api/bid-floor/site/{siteId}, …/placement/{placementId}) needs view access to the site, as the banner read needs it to the advertiser; another publisher’s site or placement answers 403 whether or not it has a floor. Deleting country=* from a placement that has no bid floor answers 404, as for a site or banner, instead of 200.
• Removing an advertiser’s or site’s share (DELETE /rest-api/advertiserShares/{userId}/{advertiserId}.do, DELETE /rest-api/siteShares/{userId}/{siteId}.do) follows the sharing card’s rule. At shared width, removing a share of a user you created without a share of your own of at least Can Edit on the entity answers 403 Removing this share needs the SHARE permission…; removing your own share, at any width, answers 403 You cannot remove your own share. Removing another user’s share within your own level is unchanged.
• Site and placement piggyback calls (/rest-api/piggyback/site…, /rest-api/piggyback/placement…) need the Piggyback Pixel Tracking permission and at least a view share of the site instead of update rights, and a refusal names the view permission. Their list, update and delete answer 404 for a deleted site or placement, and a site save answers 404 for a deleted site. A create or update with a sampling outside 0–100 — campaign piggybacks included (/rest-api/piggyback/campaign/save) — answers 400 worded sampling must be between 0 and 100.
• Switching piggybacks on or off for a deleted campaign or placement (/rest-api/piggyback/campaign/enable, /rest-api/piggyback/placement/enable and their disable) answers 404, as for one that does not exist, instead of 400 or 500.
• The banner lists (/rest-api/banners and the other lists that return banners) no longer fail with 500 when one banner has no placement type; that banner carries placementType: null.
• statisticType=HEADER_BIDDING on the analytics report now runs the Header Bidding report instead of failing.
• Listing or installing templates from the library needs permission to create templates and to view all templates.
• Banner tracking codes refuse an unknown country key; banner targeting creates accept the same parameter names as the other levels; re-posting an existing targeting rule switches targeting on; server-side tracker URLs must be http or https.
• Values beyond a field’s limit answer 400 with a field error instead of 500: a PMP deal bid floor above 1000, a CPM threshold above 999.999, a negative price adjustment.
• The price-adjustment rule list answers 403 instead of an empty list when the caller lacks access; without an AJAX invocation domain, Universal JS and Mount JS are refused with the reason; HTML5 archives may end in .ZIP.
• Blocked-placement and blocked-site rules refuse Match / Not Match, and a Day/Time window whose start equals its end is refused.
• New: header-bidding tags (/rest-api/hb-tags), creative weights (/rest-api/banners/weights.do), video requirement presets (/rest-api/video-requirements/presets), serving traces (/rest-api/serving-traces/…), a placement’s daisy chain (/rest-api/placements/{id}/daisy-chain), and an extended Advanced video file list (/vast/media-files).
• New: restoring deleted entities (/rest-api/deleted-entities/…), empty-report checks (/rest-api/analytics/report-check), link checks (/rest-api/url-check), raw-log analysis (/rest-api/analytics/raw-log-analyze), template-creative settings (/rest-api/banner/{bannerId}/template-properties) and the AI assistant usage report (/rest-api/ai-chat/usage.do). See the API reference.
• New: finding, removing and replacing stale location rules (/rest-api/targeting/stale-locations, …/remove, …/replace). See Clean up stale location targeting.
• New: re-applying auto-linking (GET to preview and POST …/apply on /rest-api/{sites,placements,campaigns,banners}/{id}/auto-linking) and campaign and creative weights on one placement (/rest-api/campaign/{id}/placements/weights, /rest-api/banners/{id}/placements/weights and …/placements/{placementId}/weight to set or reset one); the linked-placement and linked-banner lists carry the weights as campaignWeightOnPlacement / weightOnPlacement.
• The template list (/rest-api/template/list.do) now honours start, limit and onlyTotal, and total is the full count; a request without paging parameters still gets every template.
• GET /rest-api/banner/{bannerId}/video-compliance.do adds renditions: each rendition of an Advanced Local Video creative with its verdict per linked site.
• Requests the API cannot take answer 400 or 406 instead of 500: a parameter combination the endpoint does not accept (the message names the accepted ones), an upload without its file, and an Accept header asking for something other than JSON (406). See Error codes.

Bug fixes

• Display viewability credited the wrong banner when several tracked banners shared a page: each of them reported as the last banner shown. A banner in a background tab could also count as viewed. Each banner now counts under its own id, and only while at least half of it is on screen in the tab the visitor is looking at, so viewable figures for pages with several banners change. See Viewability.

• The click pixel of a click-through placement never counted a click. A partner firing the Click pixel URL got its image back, but no click was recorded. It now counts like the click-through URLs do, so these placements start reporting clicks (and CPC spend); clicks fired at the pixel before this release cannot be recovered. See Click-through placements.

• A targeting change could wait for the ad servers’ next full refresh — up to 10 minutes — even when the change itself reached them within seconds. It now applies to the next request.

• Programmatic partners missed bid requests and win notices under load. A partner could be skipped while connections to it were free; bids in flight were dropped as no-bids each time the ad server renewed its connections; and a win or loss notice the partner’s connection limit refused held the ad request for five seconds before a single retry. Calls now go out whenever a connection is free, bids in flight finish, and refused notices are retried in the background after 5, 15 and 45 seconds.

• Win and loss notices are sent only to public web addresses. Epom now sends a notice URL from a programmatic partner’s bid only when it is an http or https address on the public internet; any other is skipped without affecting the auction. See OpenRTB integration reference.

• Editing a JS piggyback in the grid joined its lines, so a // comment swallowed the rest of the tag on save. It now opens in a code editor. See Piggyback pixels.

• Typing quickly in a form with drop-downs — the analytics filters, a banner’s form — could end in an error page.

• Some users got an error page instead of the console when their city or region name has accented letters (Île-de-France).

• Newly saved links showed as unticked until the link tree finished reloading, which takes seconds on a large tree.

• One renamed city in a location rule kept a whole campaign from serving. A place the geo database has renamed or merged is now ignored while the rule’s other places still resolve. See Add targeting.

• A creative’s <template> arrived empty with the Universal JS code, and the scripts inside it ran at once. Template content now stays in place, unexecuted, so a creative can keep code aside for later (for example a tracker fired on viewability). Creatives that are a whole HTML document, that hold a consent-gated <script type="text/plain">, JSON in data-* attributes, or that write scripts with & in the URL also render as the browser would render them.

• An HTML5 ZIP zipped as its folder uploaded fine and served a blank ad. The upload now lifts the creative out of its folder, renames an entry page called Index.html to index.html, copies one called index.htm, or the only page under any other name, to index.html (keeping the original too), and drops __MACOSX/ and other system clutter. A ZIP with no clear entry page is refused with the reason. Creatives already stored are unchanged; upload a broken one again. See HTML5 ZIP creatives.

• Block rules were skipped when an entity combined rule types with OR. Blocks are now always enforced.

• Targeting rules saved as Match / Not Match on types other than Channel failed every request. They are converted to Include / Exclude and filter as configured.

• DSP partners got no app traffic when inventory masking or publisher-field hashing was on, and requests whose page address was not a web address (about:blank, app links) reached no DSP partner. Both fixed.

• Second-price auctions could end without a winner when the runner-up bid sat under the winner’s floor. They now clear at the floor.

• Wins from ExoClick, TrafficHaus and Topple were lost when their markup contained a bare &.

• Saving Validation settings switched fraud validation off, because both boxes always showed unticked.

• Regenerate keys did not change your REST API keys. It now rotates them and shows the new pair.

• ${AUCTION_MBR} was sent inverted. It is now clearance price ÷ bid.

• Video creatives with verification scripts escaped the creative scan as if they were VPAID; they are scanned now.

• Rejected (fraud) conversions set action capping, hiding the ad from that visitor. They no longer do.

• A cleared preset group kept targeting until the server restarted; it now stops within minutes.

• Deleting a conversion action left its per-action limits in force. They are removed with the action.

• After renaming an advertiser or campaign, ads kept the old names in $$ADVERTISER_NAME$$ and $$CAMPAIGN_NAME$$ for a while. They update at once.

• A video creative being saved could break the whole video response for a few seconds. It is now skipped until its file is there.

• Creatives whose file names contain non-Latin characters lost their files on some networks. The files are restored, and videos with a space in their name are compressed again.

• No-Click capping kept limiting after its card was switched off; an IP range written as CIDR (10.0.0.0/24) covered a single address; a password changed from the Users page left the user’s sessions open.

• In a Campaign-type daisy chain without Apply priorities, House ads competed with paid campaigns.

• Removing every label from a banner, campaign or placement was not saved.

• A placement’s Linked Banners grid said “Failed to load” whenever it had banners.

• Escape in a dialog closed the dialog and lost your edits when you meant to close a picker inside it.

• Campaign Estimated CTR values near the limit failed with Internal server error; Conversion per IP time frame was not saved; the Auto placements Size picker was empty.

• The Matched Inventory placements list failed for users without access to all inventory.

• Resetting action limits could stall, and a full reset left request counters standing.

• A string template property without Max length refused every value; bulk Labels now reports rows it could not change.

• The uc consent flag now puts clicks and tracking hits in GDPR scope too, like the ad request; expression targeting on user agents containing ”/” or quotes works.

• URLs, ids and code in table cells read backwards in Arabic, Hebrew and Urdu.

• Billing Year selects stopped at 2026.

• Third-party tracking codes on HTML Code creatives were never served. They now go out with the creative, as on every other type. See Third-party tracking codes.

• Piggyback sampling cut conversions it should not have. The lowest Sampling among every URL row applied even to rows that do not fire for the conversion; only the rows that fire for it count now. See Piggyback pixels.

• A piggyback’s Sampling could be saved above 100, and a negative one failed the save. Every campaign, site and placement piggyback save now keeps it between 0 and 100 and says so on the field.

• Cloning a placement or a campaign reset its piggybacks’ Fire for to all conversions; clones keep it now.

• A piggyback save naming an unknown piggyback, or a grid save for an unknown site or placement, failed with a server error. It now says what was not found. Piggybacks can no longer be added to a deleted site.

• Duplicate Set price-adjustment rules gave different prices from one server to the next. The most recently created one now wins everywhere, and saving a second matching Set rule warns you. See Create price adjustment rules.

• No-fill tracking codes went out with their macros unexpanded, so the vendor’s pixel came from the browser cache; and on an Always redirect placement the code corrupted the redirect link.

• Banners saved with the Any Size ad unit never served. The banner’s Ad unit list no longer offers this placement-only unit; a banner already saved with it shows an empty Ad unit until you pick its real size. See Image banners (Local File and External File).

• Vpaid opportunities read 0 on some Advanced reports; they show the real figure now.

• Saving a user reset settings the form does not show — interface style, analytics view, tracking and more. They are kept now. A change to a user’s password or contact details without Manage Preferences is refused instead of being dropped behind a success message, and creating a user without it is refused with Creating a user requires the Manage Preferences permission. See Manage network users.

• Admin pages opened by URL past the role’s permissions now show Record not found; DSP partners analytics needs its own permission in the new interface, as in the classic one. Admin pages granted to a user only through an individual permission entry no longer open in the new interface — ask Epom support to grant them on the role.

• The site and placement Limits switch said Access denied to roles holding only the inventory limit permission. See Set volume limits and budgets.

• Refused admin saves showed as Done — they now show the reason. Under the GDPR policy Default the consent fields are locked, as in the classic interface.

• Conversion actions: actions named before the name rule can be saved again, copies keep their attribution settings and get a valid name, and a funnel with a deleted step stays listed and deletable. A funnel saved through the API with the same action twice is refused, naming the action, instead of failing with a database error. See Create and edit conversion actions.

• Dashboards and scheduled reports: Add to dashboard works for line charts; Header Bidding and Targeting Cookie widgets and scheduled e-mails return data; a template with no column set mails every column you may see; recipients must be valid addresses. See Save, reuse and schedule reports.

• Analytics: $$SCREEN_WIDTH$$ / $$SCREEN_HEIGHT$$ carry the tag’s screen size instead of null; Device Vendor, Model and Model Code follow their permissions in Group by; a widget’s Placement Size filter applies. See Macros.

• Banner and placement forms: native banners saved without file flags no longer fail; save notes after Banner saved are no longer red errors; native asset sizes are labelled as exact; placement fields that do not apply to the placement type are hidden.

• Pricing: adding a price says why it failed; a pricing CSV upload for a flat-fee model and CSV errors show a clear message; the CPM-threshold country picker no longer starts on the US. See Configure pricing.

• Statistics accounts refuse a username or e-mail already taken instead of saving it changed. See Share sites and advertisers with users.

• Mail: unsubscribed addresses no longer get mail in Name <address> form or as BCC; the unsubscribe footer names your white-label company instead of Epom; long e-mail template subjects save. See Notifications & outbound mail.

• Admin settings: a DSP partner needs a name and a bid URL; the new sign-in page honours Hide sign-up; a new role can no longer be built on a deprecated static role; a VPAID framework needs its file; self-serve floor-rate CSVs accept OS constant names and a re-upload replaces the rates. See Configure DSP partners and Configure the self-serve campaign catalogue.

• The placement API request URL had no host when the placement had no stored serving domain.

• The assistant’s reports broke for non-English interfaces. Sorting and totals found nothing for a German or Ukrainian account; they now work in every language.

• A Shared View grant on a role read every user of that role. A role with only Shared View on another role — as the stock Advertiser and Publisher roles hold on their statistics-account role — could open any of that role’s users by id and read their contact details. It now reads only the users it owns (the statistics accounts it created); sharing with that role’s users works as before.

• The REST API and the Shares page removed shares the sharing card refuses. Removing an advertiser’s or site’s share now follows the sharing card’s rule everywhere: at shared width you need a share of your own of at least Can Edit, as high as the one removed or on a user you created, and nobody removes their own share. Over the API a user could remove a share of a user they created without holding a usable share themselves, and anyone could remove their own; on the Shares page a Can View holder could remove its sub-accounts’ shares and anyone could remove their own row. Those removals are now refused; nothing that was refused becomes allowed. See Sharing a single entity from its edit page.

• The Bid floor card could save floors on a site, placement or creative that had been deleted, and deleting rows or uploading a CSV after the card was switched off in another tab failed with an error. A deleted entity now answers Record not found and nothing changes; the delete succeeds without changing anything, and the CSV upload switches the floor on first, as Add does.

• Feature-card switches could change something already deleted. Switching targeting, capping, limits, pricing, the bid floor, rules, piggybacks, tracking codes, server-side trackers, content replacement, daisy chaining, hard linkage or revenue share on or off for an advertiser, campaign, banner, site, zone or placement deleted meanwhile (in another tab, say) now answers Record not found and changes nothing, and these switches apply one at a time per entity. A Rules switch you may not use now says why and flips back, instead of staying switched although nothing was saved.

• A placement’s Linked banners tree said Banners saved when the save failed. It now shows the reason and keeps your unsaved ticks.

• A conversion for a deleted campaign, or a paused one with conversion tracking off, answered error (“the ad server failed”) instead of being refused. It is refused again with banner-unknown or campaign-unknown. See Why a conversion did not count.

• Bids from DSP partners that bid in their own currency were compared with the floor in the wrong currency, so depending on the rate a bid over the floor was refused or one under it won, and a second-price win could clear below the floor. Bids are now held against the floor in US dollars. See Configure DSP partners.

• Changing the network’s billing is now Epom support’s job. Saving or activating a plan, switching the pricing type, editing the billing organization or a monthly record and recalculating charges used to be allowed from the view-only Ad Server Fees page; the page no longer offers those controls — ask Epom support or your account manager. See Finances, fees and referral billing.

Under the hood

The assistant runs on Anthropic’s Claude API; attachments are kept in your network’s existing file storage. If your network receives the raw event export in its own storage, an hour that failed to upload is now retried hourly; Epom support can re-send older gaps. A video file added to a creative is now pulled into the CDN before its first viewer asks for it, so the first impressions of a new video no longer wait for the CDN to fetch it. Ad serving does much less work per request — targeting, capping, bid requests, tracking links and macros are worked out once instead of over and over. Where campaigns use same-page exclusions, the slots of one page are no longer served strictly one after another, and a slow geo service no longer slows ad requests down. An ad server restarted after a crash starts only from a complete, consistent copy of its ad cache, never from parts saved at different times.

Related

• What’s new in Epom Ad Server
• Work with the AI assistant
• Get the most out of the AI assistant
• Restore something you deleted
• Connect an AI assistant (MCP)
• Release 152