deepline-ads-audiences

Deepline Ads Audiences

Quick Start

npm install -g deepline
# Fallback for secure sandboxes: mkdir -p "$HOME/.local" && npm config set prefix "$HOME/.local" && export PATH="$HOME/.local/bin:$PATH" && npm install -g deepline --registry https://code.deepline.com/api/v2/npm/
deepline auth register --wait auto
deepline auth wait --timeout 120 # completes Cowork/browser approval; no-op if already connected

CLI resolution

Run deepline when it is available. If the shell reports that command is missing, use <workspace-root>/.deepline/runtime/bin/deepline (or the npm-created .cmd shim on Windows). If neither exists, follow https://code.deepline.com/INSTALL.md to set up Deepline.

Build high-quality ABM paid ads audiences from first-party customer or prospect lists. This skill is for paid ads audience upload and evaluation, not outbound.

Names in this skill are starting hints. Run deepline tools search audience --json and deepline tools describe <tool_id> --json before executing because tool names and payload shapes can change. Tool search accepts an intent query or, for structured filtering, --categories and/or --search_terms; a filter-only search needs at least one of those flags. Use commas for multiple filter values, and put provider names in the query rather than using a --prefix flag.

Before You Start

Use the full recipe when the user asks to enrich and upload audiences to Facebook/Meta and Google:

→ Read recipes/enrich-and-upload-facebook-google.md.

Use the max-coverage recipe when the user asks for "max coverage", "maximum match rate", "keep increasing coverage", "get to 75% coverage", or asks to exhaust LinkedIn/personal-email/hash options:

→ Read recipes/max-coverage-audience.md.

This skill is not for cold outbound, sequencing, or copywriting. Personal emails here are used to improve paid ads matching, not to contact people directly.

Decision Matrix

Default Workflow

1. Confirm rights, use case, and geography.
2. Discover uploadable ad accounts.
3. Build baseline and enriched audience objects.
4. Validate identifiers and expected match-rate lift.
5. Create separate platform audiences.
6. Upload rows.
7. Check status and report IDs, uploaded counts, invalid rows, and current build state.

Ask about suppression before targeting

Every audience run has a second list hiding in it: the people who should never see the ad. Current customers, closed-lost accounts, active opportunities, employees, and recent converters.

Ask for it explicitly, because users rarely volunteer it and the failure is invisible. A suppression list that was never built, or that silently failed to sync, spends budget advertising to people who already bought.

The risk is asymmetric, which decides how to handle edge cases: an extra person on a suppression list costs a few unserved impressions, while a missing one costs real money and can annoy a customer. When you are unsure whether someone belongs on it, include them.

Suppression lists match on the same identifiers as targeting lists, so a work-email-only suppression list suppresses almost nobody. Enrich it with the same ladder, or it will not do its job.

Expect different lift per platform

Enrichment does not pay off evenly. Meta gains the most from personal-email enrichment, because personal addresses are what people register with there. Google gains less, since a Workspace address is already a Google account and often matches from the baseline.

Set that expectation before spending. A user who was promised uniform lift reads a modest Google result as a failed run, when it is the expected shape.

Explain the shape before you spend

Users new to paid ads usually have not met hashed identifiers before, and a plan that opens with provider names reads as an opaque menu. Before running the ladder, state the mechanic in one or two sentences so the user can judge the plan rather than approve it blindly:

Ad platforms can only match people on identifiers those people gave the platform. Your CRM holds work emails; almost nobody signs up to Meta with a work address. These layers buy the personal identifiers that do match, cheapest first.

Say what each layer costs in Deepline credits and what it is expected to add, then ask for approval before the first paid layer. A user who understands the mechanic will make a better call on where to stop, which is the only decision that controls spend here.

shared/audience-basics.md holds the longer explanation, including what a hash is and why it is safe to send. Point the user there when they ask, or when the run is their first.

Coverage Modes

Choose the coverage mode before spending credits. Record it in the run notes.

Never silently downgrade a max_coverage request to cost_effective. If a provider or credential is unavailable, report the gap and continue with the next approved provider rather than stopping early.

Shareable Plays

This skill includes copyable play templates under plays/. Use them when the user asks for a repeatable or shareable workflow, not just a one-off CLI run.

Before running a template, check the installed surface when it is unclear:

Use deepline plays for the bundled templates. If deepline plays is unavailable, stop and ask for the Deepline SDK CLI to be installed or updated instead of approximating the upload through older command paths.

Recommended sequence:

Export dataset outputs after a run with:

Before using the upload play, run account discovery from Step 2 and confirm the selected Google Ads account name and ID with the user.

Step 1: Confirm Rights

Ask for explicit confirmation when the source data belongs to a customer workspace or third party. The minimum confirmation is:

• The source list can be used for paid ads audience creation.
• Any enrichment identifiers can be used for paid ads matching.
• The requested platforms are allowed for this use case.
• Geography is in scope. Default to US-only when personal identifiers are being enriched unless the user specifies otherwise and confirms compliance.

Do not use this skill for outbound email, phone, or sequencing. The output is audience upload data and platform audience IDs.

Step 2: Discover Uploadable Accounts

Run account discovery before every live upload. Agents often guess account IDs from prior context, app IDs, or UI labels. That creates audiences in the wrong account or fails after enrichment spend has already happened.

Use this discovery ladder:

1. Search for live account tools:

2. If a platform exposes a direct account discovery tool or endpoint, use it first. Record account name, account ID, platform, permission status, and whether customer list upload is supported.

3. If no direct discovery tool is exposed, ask the user for the account ID and name, then validate it before upload:

4. Show the discovered choices back to the user as Account Name (Account ID), grouped by platform. If there is more than one plausible account, ask which one to use before creating audiences.

5. Keep the selected account IDs in the run notes and final answer. A Meta app ID is not an ad account ID; the two look similar enough that agents substitute one for the other, and the upload then fails or lands in the wrong account after enrichment has already been paid for. Meta upload IDs look like act_123... or a numeric ad account ID that Deepline can prefix.

Step 3: Build Baseline and Enriched Objects

Create two separate objects when evaluating lift:

• unenriched: first-party source identifiers only, usually work email plus name, company, country, postal code, and LinkedIn URL context.
• enriched: source identifiers plus paid-ads-safe enrichment. Prefer hashed personal email providers first, then raw personal-email providers that can be normalized and hashed locally.

Run this as a waterfall, not a fan-out. Every layer below runs only on rows that still have no usable hash. Sending the same row to several providers costs several times over for one identifier, and it hides: every call returns 200, so the run reads as healthy while the bill multiplies. plays/enrich-audience-waterfall.play.ts enforces the skipping and reports attempted, hits, and skipped per layer, so a fan-out is visible in the output.

Default personal-email waterfall for B2B paid ads:

1. Baseline first-party identifiers: valid work emails, names, company, country, postal code, LinkedIn URLs, and stable external IDs.
2. Aviato aviato_pull_email_hash: run on all eligible rows with enough identity context, including rows that already have work emails. Use it when the goal is ad upload and the provider returns paid-ads-ready personal email hashes. If the output cell is a JSON object, extract the scalar hash from matched_result, result.data.hashedEmails[0], result.data.hashed_email, or equivalent hash fields. Do not treat the JSON object string as the upload value.
3. LimaData limadata_find_audience_identifiers: run on rows still missing a personal hash after Aviato, or run it first when the user asks for the most cost-effective expansion pass. Extract only normalized 64-character SHA-256 hashes from matched_result, result.data.hashed_emails[].normalized_hash, hash, or sha256 fields. ContactOut hashed identifiers do not belong in this numbered list, because they cannot waterfall. Run them as a separate bulk pass. See the section below.

ContactOut hashed identifiers (quick reference)

ContactOut converts LinkedIn URLs straight into hashed emails, but it does not waterfall: the response is an unattributed pool, so it cannot skip rows another provider covered and later providers cannot skip rows it covered. Run it as a bulk pass beside the ladder.

• Send set: rows with a verified LinkedIn URL. Exclude rows that already have a hash for cost_effective, include them for max_coverage.
• Batch 5 to 100 per call. A zero-match chunk returns HTTP 404 and is not billed.
• Bill and report from matches_found, never the hash-list length.
• Merge into the audience-level hash pool, not per-row email_sha256 cells.

→ Read shared/contactout-hash-pool.md before planning or running a pass. It covers why attribution cannot be recovered, the measured overlap and multi-address rates, and the Meta result.

A work email is not a personal hash

Scope the waterfall on whether a row has a usable personal identifier, not on whether it has any email. A work-email-only contact must run through every layer; a work email is the L0 baseline.

The same mistake hides inside a personal_email column. In one run 151 rows held a corporate address there, and each one exempted a contact from enrichment. Re-running only those rows hit 64.9%, against 27.5% on the main pass, for 4.23 USD. Check the domain, not the column name.

Order the ladder by what a miss costs

Two providers at similar prices are not equivalent, because they bill differently on a miss:

Measured on one 5,549-row list, cheapest first:

Run the cheapest per-call provider first so it absorbs the easy hits. A low hit rate on the remainder means the pool is exhausted: LeadMagic cost 4.76 USD to establish that, where a per-call provider bills the same for the same answer.

Stop after the hash providers by default. Report attempted rows, row hits, unique hashes added, contacts still missing personal hashes, and Deepline spend. Then ask whether the user wants to spend more on broader raw personal-email providers, quoting the current per-contact cost from deepline tools describe <tool_id> --json rather than a remembered figure. Rates change, and a stale quote in an approval gate is how users end up agreeing to a number that no longer holds.

Only run the expanded coverage pass after explicit approval. In that pass, try providers such as LeadMagic, ContactOut, Wiza, Datagma, Crustdata, Prospeo, FullEnrich, PDL, or Deepline native personal-email waterfalls on rows still missing personal hashes. Normalize and SHA-256 hash raw personal emails exactly once, record provider-level lift and Deepline spend, and keep the default upload payload hash-only.

Leave mobile phones out unless the user explicitly asks for them. They cost considerably more per contact than hashed emails, and a phone layer can consume most of a test budget before the cheap email layers have finished proving what the list can reach. Phones are worth adding as a second identifier alongside email, not as a substitute for it.

For max_coverage, the user has already approved the goal but not unlimited spend. Ask for or infer a budget cap before any paid fallback past the hash layer. If the user gave a cap, run the expanded pass until the cap or marginal-lift stop condition is reached.

For native waterfall outputs, include only provider-specific fields that are confirmed personal-email responses, such as first_personal_email, personal_email, personal_emails[], or Wiza email values where email_type is personal. Do not include an untyped final scalar just because it contains an email address. Untyped final values can be work emails.

Keep row lineage in both objects:

• external_id
• source_row_number
• person_linkedin_url
• company_name
• company_domain
• provider_used
• identifier_type

This lets the user evaluate whether enrichment improved upload coverage without losing the source list.

LinkedIn URL Backfill for Audience Enrichment

When LinkedIn URLs are needed before personal-email/hash enrichment, use a measured query ladder instead of one exact-company query. In a high-priority ABM eval sample, exact account-name search recovered the known URL in the top five for 51.7% of rows, while the account-or-LinkedIn-company query recovered 65.8%. Quoted domain search was much worse (5.8%) and should not be a first-pass default.

Start with prebuilt/person-to-linkedin-harvestapi when available. It searches with the supplied company name and domain, then validates candidates with native HarvestAPI. Normalize noisy company names before calling it, for example:

• RTX Corporation → RTX
• Lockheed Martin Corporation → Lockheed Martin
• NASA - National Aeronautics and Space Administration → NASA plus a secondary long-form alias
• L3Harris (formerly Aerojet Rocketdyne) → L3Harris
• Siemens Energy Global GmbH & Co. KG → Siemens Energy
• Airbus EMEA → Airbus

The first Serper query should use those cleaned account/LinkedIn company aliases:

Then validate candidates before using them:

1. Keep only linkedin.com/in/ URLs and strip query params/trailing slashes.
2. Reject search results where the profile title does not contain a first-name match and a last-name match. Allow common nicknames and meaningful first-name prefixes; do not accept single-letter last-name initials as validated.
3. Use company/title evidence as supporting evidence, not as identity proof.
4. For ambiguous candidates, retrieve the profile with harvestapi_get_profile and validate element.firstName, element.lastName, current company, and headline before merging. This catches snippet false positives such as a search result mentioning the target name in another person's experience section.

Use follow-up queries only after the first pass misses:

Do not make quoted domain ("{{domain}}") the first query. It can help occasional rows, but in the eval sample it reduced recall and caused more provider failures.

Step 4: Validate Identifiers

Before upload, remove empty strings and malformed hashes from the payload. Deepline platform validators reject empty email fields and non-64-character email_sha256 values.

Valid upload row fields include:

• email
• email_sha256
• phone
• phone_sha256
• first_name
• last_name
• country_code
• postal_code
• company_name
• title
• company_domain
• person_linkedin_url
• external_id

Prefer email_sha256 when a provider returns a paid-ads-ready hash. Provider hashes must pass through exactly as lowercase 64-character hex. Do not double-hash provider hashes.

Standard upload file shape

Use one shape for every run, so the audit, the Sheets export and both platform uploads read the same file:

• email and phone hold 64-character lowercase SHA-256 digests, or nothing.
• Every row carries at least one of the two. Drop rows with neither.
• fn and ln are lowercase a-z only. country is a two-letter code.
• Keep a parallel ..._lineage.csv with a source column naming the layer that produced each hash.

Blank cells are deliberate: a ContactOut-pool row has no name, a phone-only row has no email.

Before uploading, assert that each column holds one identifier type and that no value is the SHA-256 of another value in the file. Both failures upload cleanly and match nothing. → Read shared/upload-failure-modes.md.

When a provider returns raw personal email:

1. Trim whitespace.
2. Lowercase the email.
3. Validate it with a normal email pattern.
4. Hash the normalized email with SHA-256 exactly once.
5. Upload only email_sha256 unless the user explicitly asked to upload raw email fields.

Normalize LinkedIn URLs (drop encoded internal-identifier URLs)

The Ad Audiences APIs (batch and live) accept only vanity LinkedIn URLs — linkedin.com/in/<username> (e.g. linkedin.com/in/scott). They do not accept encoded internal-identifier URLs, where the slug is an opaque member-identity token — e.g. https://www.linkedin.com/in/ACwAAA3jFR0B90FE7rqSIhnof5R9h57ZrfgYR7w. These come from Sales Navigator exports and some enrichment providers. The endpoint tolerates them today but will return 400 for that input soon, so treat an encoded URL as invalid person_linkedin_url before upload.

Detect and handle every person_linkedin_url cell:

1. Detect encoded — the slug after /in/ starts with ACwAA / ACoAA (or is a long single-token Base64URL-ish string, ~30+ chars of [A-Za-z0-9_-] with no hyphenated name and no digits-as-suffix). That is an internal identifier, not a username.
2. Do not upload it as-is. Drop the encoded value from person_linkedin_url for that row so the platform validator does not reject the whole payload.
3. Recover the vanity URL when the row still needs LinkedIn coverage — run the LinkedIn URL Backfill ladder from Step 3 (native person-to-linkedin, then the Serper name + company query) to resolve the real linkedin.com/in/<username>. This is the same helper that produces upload-ready vanity URLs elsewhere in this skill.
4. Keep vanity URLs as-is — linkedin.com/in/<username>: strip query params and trailing slashes, lowercase the host, and upload.

Report, in the Step 4 audit, how many person_linkedin_url rows were encoded (dropped), how many were recovered to a vanity URL, and how many were already valid — an all-encoded input silently uploading zero LinkedIn identifiers is the failure this step exists to prevent.

Before live upload, write a small audit with:

• source row count
• valid baseline work-email count
• provider row hits
• hashes seen by provider
• unique hashes added by provider
• invalid hash rows
• whether any raw email field remains in the upload payload
• LinkedIn URLs: encoded (dropped), recovered to vanity, already valid

Step 5: Create and Upload

Create one audience per platform per object. Name them so the account UI makes the test clear:

• <customer or segment> enriched <date>
• <customer or segment> unenriched <date>

Then upload each object separately.

Current starting hints:

Use append for Google when uploading into a newly created empty audience if replace returns provider-side Data Manager payload errors. Report that clearly because it indicates connector behavior that should be fixed.

Upload the whole audience in one call

Meta locks an audience on write and rejects later writes with HTTP 422 until ingestion finishes, so a batched loop leaves the audience holding part of the list. Send every row in one sync_audience_members call, and pass the payload as --payload @file.json because inline JSON exceeds the shell argument limit.

Omit blank string fields rather than sending ""; the schema declares minLength: 1 and an empty value fails the whole batch. → Read shared/upload-failure-modes.md.

Step 6: Verify and Report

Read Google's match rate from ingestedUserListInfo.contactIdInfo.matchRatePercentage. The matchRateRange enum beside it stays unset, so reading the enum alone reports null for an audience with a real rate, and a report that renders null as 0% turns a good run into an apparent failure. Meta exposes no per-audience match rate.

uploaded_count and invalid_count describe whether rows parsed, not whether people matched. Report acceptance and match rate separately. → Read shared/upload-failure-modes.md.

Run status checks after upload:

Final answer format:

• Platform and account name plus ID.
• Audience name and audience ID.
• Object type: enriched or unenriched.
• Uploaded count.
• Invalid count.
• Request IDs or session IDs.
• Current status. Note that match size and match-rate ranges may stay null while platforms process the audience.

If upload fails, report the provider error category and request ID. Do not say the audience worked unless create, sync, and readback status all succeeded.

Google Coverage Follow-Up Reporting

After Google match rates populate, use plays/report-google-coverage-lift.play.ts to prevent hand-calculation drift. The play should be run from the same match-rate readback that listed the Google account name and ID. It calculates:

• percentage-point lift versus baseline
• relative lift versus baseline
• estimated matched identifiers from uploaded rows and match rate
• incremental matched identifiers versus baseline
• Deepline spend and blended cost per incremental matched identifier when spend is provided
• a ready-to-send follow-up note

Use anonymized or customer-approved values in customer-facing follow-up notes. Keep account IDs, audience IDs, match rates, spend, and provider-layer labels tied to the current run artifact rather than copying old example values.

Do not expose provider-side unit costs in customer-facing messages. Report Deepline spend only.

Reading guide