A bid response can be valid JSON, satisfy every local field constraint, and still answer the wrong auction. Its id can belong to another request. Its impid can name an impression that was never offered. Its currency can sit outside the request's allowed set. None of that is visible in the response alone.

The same problem shows up one step earlier. OpenRTB integrations share field names without sharing one wire contract. The specification types many flags as integers. The IAB protobuf model types a set of those fields as booleans. Google's Authorized Buyers JSON adds its own serialization. Prebid Server's publisher-facing auction adds bidder selection and stored requests. A value that is acceptable at one boundary is a useful diagnostic at another.

That is why "is this OpenRTB valid?" is the wrong question until the check names four things: the specification snapshot, the wire encoding, the integration direction, and whether an originating request was supplied.…