Guide 96 · Admin · GA4 + Tag Manager
The Measurement Protocol validation server: check the event before production, and read every message
The validation server at debug/mp/collect checks your Measurement Protocol event and returns a list of validation messages. An empty list is the pass; anything in it is a fix.
After the trace, the same body posted to the validation server returns an empty list of validation messages, and only then is the body sent to the production endpoint.
Download the reference: the measurement protocol validation reference (JSON) (498 bytes, MD5 c8364f89e5cb5ad848a9b5663b1e7fa6). It holds the worked example from this guide with every figure recomputed. The file was built for this guide and checked the same day; it was not exported from a live property.
What you need
- The exact POST body you plan to send in production.
- The Measurement ID and API secret, as query parameters.
- A note that the validation server does not check the API secret.
The trace
- Change only the URL. The production endpoint is /mp/collect and the validation server is /debug/mp/collect. The body is the same. Events sent to the validation server do not appear in reports.
- Post the body to https://www.google-analytics.com/debug/mp/collect with the Measurement ID and API secret in the query string. Use the Event Builder in Google's developer docs to build the same body interactively if you prefer.
- Read the list of validation messages in the response. An empty array is the pass. Each message names a field path, a description and a validation code. Fix every message before you ship; do not ship with messages you have not read.
- Set the validation call to ENFORCE_RECOMMENDATIONS while validating. Google's guide recommends this for the validation call, and sending production requests without it, to keep rejected data low.
- Check the worked example in the download. A generate_lead body with client_id, event name and one parameter returns 0 validation messages. The same body with the event name missing returns 1 message naming the missing field. The count of messages is the verdict.
- Remember what the server does not check. The validation server does not validate api_secret, so a typo in the secret passes validation and still fails in production. Check the secret separately, character by character, against the stream settings.
Dead ends
DEAD END — VALIDATING A DIFFERENT BODY. A body that passes validation is not the body you ship if you edit it afterwards. Validate the exact body, then ship that body unchanged.
DEAD END — A SECRET TYPO THAT PASSES. The validation server does not check api_secret. A passing validation with a wrong secret still sends nothing in production.
DEAD END — ENFORCE_RECOMMENDATIONS IN PRODUCTION. That setting belongs on the validation call. Production requests go without it, to keep rejected data low.
End state
The valid body returns 0 validation messages; the body with the event name missing returns 1. The API secret is checked separately, because the validation server does not check it.
Sources
- Google Analytics — Validate events — the validation server URL, the validation messages in the response, the ENFORCE_RECOMMENDATIONS setting, and the API secret warning
Checked 11 November 2026. The click paths above are the ones in Google's help and developer pages, opened 11 November 2026. No step in this guide was run inside a live Analytics property or a live Tag Manager container, because both need a Google sign-in and this site does not sign in as anyone. The figures on this page were recomputed in Python 3 and are shown in the downloadable file, which was checked the same day. Google moves menu items without warning; if a path on this page no longer matches, the linked help page is the current map.