Inbound request filters
Every inbound OpenRTB request is checked before it costs anyone compute: device.ip and device.ua are mandatory, the user agent must resolve to our browser allow-list, and adult and illegal content categories (IAB25, IAB25-3, IAB26) are rejected on mainstream endpoints. Advertiser-domain blocklists (badv) are applied at the publisher level.