Meta App Review record + next retry

Submitted record and corrected copy bank

This page preserves the July 7, 2026 Meta submission record and provides corrected copy for the next ads_management review. Historical claims are labeled as historical. Current reviewer instructions match the campaign-only creation workflow, with the private reviewer code redacted from this public page.

App The Contractors Marketing API

App ID 2922907381250168

Use case Create and manage ads with Marketing API

Reviewer demo https://thecontractorsmarketing.com/meta/

Copy controls

Historical facts are labeled; current copy is prepared for the next ads_management retry.

Previous submission lessons

What July 7 proved and what the next retry corrects

Historical July 7 record: scheduled clean Marketing API reads addressed the earlier eligibility issue, and Meta's Testing use cases page showed its runtime checks completed. Those checks were operational evidence, not App Review approval. Meta later approved the tier and four read/business permissions but rejected ads_management because the reviewer proof did not demonstrate creation.

Gate 1

Fresh Marketing API eligibility

The submission referenced clean-call proof and same-day Meta Testing use cases eligibility status.

Gate 2

End-to-end screencast

Each uploaded recording showed the system-user grant path or explained it, then showed the permission being used inside the app.

Gate 3

Live reviewer demo

Historical July 7 runtime snapshot: the public /meta/ console reported no blockers. That runtime state did not itself mean ads_management was approved.

Gate 4

Next-retry alignment

The corrected copy, live UI, endpoint behavior, and new screencast must all show the same campaign-only creation flow.

Reviewer note

Previous rejection lesson to keep in every submission field

 The Contractors Marketing API is an internal agency operations app that uses preassigned Meta Business Manager assets and a server-held system-user token. It is not a consumer-facing Facebook Login app. Before review, a Meta Business admin has already assigned the app and allowlisted ad account to the system user and generated the app-scoped token. The reviewer walkthrough begins in the TCM reviewer console and shows sanitized readbacks of that existing authorization context. Each reviewer-initiated request creates one new campaign in the allowlisted account, with the server forcing the fixed review name prefix, objective, and status=PAUSED. It does not create or claim an ad set, ad, creative, budget, targeting, placement, or destination.

Next retry

How the ads_management rejection is corrected

 The next ads_management retry directly corrects Meta's creation-proof rejection. The recording begins at https://thecontractorsmarketing.com/meta/ in the TCM reviewer console, shows the preassigned system-user authorization context, briefly shows the connected account and existing ads_read metrics, and then moves to ads_management. It never opens Meta App Dashboard or Business Manager. The browser submits only the private reviewer code and an idempotency key. For each reviewer-initiated request, the server owns and validates the ad account, fixed review campaign-name prefix, objective, and status=PAUSED, then creates one new campaign. The server immediately reads the returned Meta campaign ID back, displays only a masked ID in the sanitized success receipt, and keeps the same receipt visible after an immediate reload under Created by this app — last 1 hour. The retry makes no ad set, ad, creative, budget, targeting, placement, destination, activation, or spend claim.

Meta form page 1

Use case and app details

Use case

Which use case should be selected?

Create and manage ads with Marketing API.

App purpose

Describe what the app does

 The Contractors Marketing API is an internal agency operations app for advertising teams that manage authorized client Meta advertising assets. The app helps agency operators validate the connected Meta business portfolio and ad account, read campaign performance, create operator-authorized campaigns, and keep a reviewer-visible audit trail. It supports the agency's day-to-day advertising workflow by using Meta Business Manager asset grants and system-user tokens for server-to-server Marketing API operations. For this App Review, each reviewer-initiated request is limited to one new server-controlled PAUSED campaign in an allowlisted review account, an immediate readback of that campaign by its returned ID, and a sanitized receipt. The review flow does not create an ad set, ad, creative, or delivery configuration.

Who uses it

Who are the app users?

The app is used by trained internal agency operators at The Contractors Marketing who are responsible for client advertising setup, audit, reporting, and campaign maintenance. It is not available as a public consumer app. Access is limited to authorized staff and authorized client business assets that have been assigned through Meta Business Manager.

Authorization

Explain the login or authorization flow

 The Contractors Marketing API uses Meta Business Manager and system-user authorization rather than a public consumer Facebook Login flow. Before reviewer testing, a Meta Business admin has already assigned the app and allowlisted business assets to the authorized system user, granted the required app permissions and asset tasks, and generated a The Contractors Marketing API-scoped system-user token. That token is stored only on the server. The reviewer does not need Business Manager credentials and is not asked to repeat the admin grant flow. The app-only recording opens directly in the TCM reviewer console, which shows sanitized app identity, SYSTEM_USER token type, runtime-scope, business, and allowlisted ad-account readbacks before the campaign action. Runtime scope is labeled as capability evidence, not App Review approval. No token or app secret is returned to the browser.

Reviewer access

Testing instructions or test credentials

This is an internal server-to-server Meta Marketing API app and does not use consumer Facebook Login. This submission requests only ads_management. A Meta Business administrator assigned the app and allowlisted review account before testing; no Meta Business credentials or reviewer grant flow are required.

The attached recording begins in the TCM reviewer console with the preassigned system-user authorization context, then shows ads_read before continuing to ads_management. For hands-on testing:

1. Open https://thecontractorsmarketing.com/meta/#ads-read. Confirm the connected business, labeled reporting account, and Spend, Impressions, Clicks, and Reach. This is existing read-only context, not a request to re-review ads_read.

2. Continue to https://thecontractorsmarketing.com/meta/#ads-management. Confirm SYSTEM_USER, the allowlisted review account, and the server-owned PAUSED campaign policy. Wait until the final preflight reports ready and the creation button is enabled.

3. Note the current receipt count. Enter the private reviewer code provided with this submission and click Create PAUSED review campaign.

4. For this reviewer-initiated request, the server creates one campaign and forces its account, name prefix, objective, and status=PAUSED.

5. Confirm the success receipt, masked campaign ID, and immediate exact-ID readback showing status=PAUSED and effective_status=PAUSED. Confirm the receipt count increases by one and the newest row matches the new campaign and review run.

6. Reload immediately and confirm the same receipt and row remain visible under Created by this app — last 1 hour. Reload proves app-side receipt persistence, not another fresh Meta GET.

This flow does not create an ad set, ad, creative, delivery configuration, activation, or spend.

Access codes

Payment, membership, or proof code instructions

 Reviewer code:

[private proof access code redacted from public copy]

Open https://thecontractorsmarketing.com/meta/#ads-read and follow the Reviewer Instructions above. No payment, membership, Facebook Login, Meta App Dashboard access, or Business Manager credentials are required.

Download payment

Paid download / app store field

Not applicable. There is no paid app download, in-app purchase, subscription, or paid membership.

Geo access

Geographic restrictions field

No geo-blocking or geo-fencing is used.

Supporting docs

Uploaded supporting documentation

 Historical July 7 artifact: tcm-meta-app-review-screencasts-2026-07-07.zip

Do not reuse the historical ads_management clip for the next retry. Upload a new ads_management recording that demonstrates campaign creation, exact-ID readback, the sanitized receipt, and persistence after reload.

Facebook Login

Is Facebook Login integrated on this platform?

No

Evidence gate

What was verified for the submitted answers?

 Historical July 7 evidence, not current approval status:

https://thecontractorsmarketing.com/api/meta/review-data

 The TCM review-data endpoint reported a passing runtime snapshot and a paused pre-existing proof chain. That historical runtime evidence did not demonstrate creation and did not mean ads_management was approved.

For the next retry, verify the current endpoint reports the app, system-user token, ads_management runtime scope, business, and allowlisted proof account as capable. Then verify one reviewer-gated campaign creation returns a sanitized receipt, reads the exact returned ID back as status=PAUSED and effective_status=PAUSED, and remains listed after an immediate reload under Created by this app — last 1 hour. Runtime scope and capability checks are evidence only; Meta App Review approval is tracked separately.

Meta form page 2

Permission and feature answers

Historical record: the business_management, pages_show_list, pages_read_engagement, ads_read, and Marketing API Access Tier answers below preserve the July 7 submission context. They are not a claim that every runtime scope is currently approved. The corrected ads_management answer is the copy bank for the next narrow retry.

business_management

Why does the app need business_management?

 Historical July 7 submitted answer; not part of the next ads_management retry:

The Contractors Marketing API needs business_management to validate the Meta business portfolio and assigned assets that an agency operator is authorized to use before campaign setup, reporting, or ad-management workflows. The app reads the authorized business portfolio, assigned Pages, assigned ad accounts, and related asset access state. This prevents operators from preparing work against the wrong business, Page, or ad account, and ties each advertising workflow to assets that were granted through Meta Business Manager.

The business_management proof console is available at

https://thecontractorsmarketing.com/meta/#business-management

The screencast shows The Contractors Marketing API-scoped system-user grant context, the verified business portfolio, assigned asset table, ad account readback, selected Page readback, and operations evidence log. This permission is used only for authorized business asset validation and ad-management context. The public demo does not claim ad accounts, change asset assignments, expose tokens, or modify Business Manager settings.

The Contractors Marketing API is a server-to-server/system-user Marketing API integration, so there is no consumer Facebook Login dialog in this workflow; access is granted through Meta Business Manager assigned assets and shown in the screencast.

pages_show_list

Why does the app need pages_show_list?

 Historical July 7 submitted answer; not part of the next ads_management retry:

The Contractors Marketing API needs pages_show_list to read the Facebook Pages assigned to the authorized business/system user and let agency operators select the correct client Page before Page engagement checks and campaign planning. The app uses pages_show_list to display only Business Manager-assigned Pages for the connected business. It reads Page name, masked Page ID, category, and assignment context so the operator can confirm the correct Page identity before pages_read_engagement checks and authorized campaign workflows.

The pages_show_list proof console is available at

https://thecontractorsmarketing.com/meta/#pages-show-list

The screencast shows the Business Manager-assigned Page list, selected Page readback, masked Page ID, assigned asset table, and operations evidence log. This permission is used read-only to list and select authorized Pages. The app does not create Pages, publish Page content, change Page settings, or expose Pages that have not been assigned through Business Manager.

The Contractors Marketing API is a server-to-server/system-user Marketing API integration, so there is no consumer Facebook Login dialog in this workflow; access is granted through Meta Business Manager assigned assets and shown in the screencast.

pages_read_engagement

Why does the app need pages_read_engagement?

Historical July 7 submitted answer; not part of the next ads_management retry:

The Contractors Marketing API needs pages_read_engagement to read Page profile and engagement context for an authorized Facebook Page before campaign planning. The app uses Page metadata and engagement metrics, such as follower count, fan count, and talking-about count, to confirm that the correct Business Manager-assigned Page is active and usable as the advertising identity. The app uses this permission only for authorized agency workflow needs, including Page validation, ad identity checks, and campaign planning context. It does not publish, edit, or delete Page content, and it does not use Page content for unrelated consumer profiling.

The pages_read_engagement proof console is available at

https://thecontractorsmarketing.com/meta/#pages-read-engagement

It shows the selected Business Manager-assigned Page, live Page metrics readback, the Page/content signal table, and the operations evidence row for pages_read_engagement. The submission also includes pages_show_list so the app can list and select the authorized Page before reading its engagement context.

ads_read

Why does the app need ads_read?

Historical July 7 submitted answer; not part of the next ads_management retry:

Provide API access to your ad performance data for use in custom dashboards and data analytics. Provide API access to your ad performance data for use in custom dashboards and data analytics. The Contractors Marketing API needs ads_read to read authorized Ads Manager ad account data for reporting, auditing, campaign health checks, and optimization planning. The app reads ad account metadata, campaigns, ad sets, ads, creatives, and Ads Insights metrics such as spend, impressions, clicks, and reach. This lets authorized agency operators review account health, understand performance trends, and confirm existing campaign state before recommending or preparing changes.

The ads_read proof console is available at

https://thecontractorsmarketing.com/meta/#ads-read

The screencast shows the app viewing authorized Ads Manager account data from the reporting proof account, including spend, impressions, clicks, reach, campaign-level insight rows, masked campaign IDs, and campaign/ad object readbacks. This permission is used read-only for reporting and audit views. The app does not create, update, or modify ads through ads_read. The ads_management creation evidence appears separately because its reviewer-gated action is intentionally isolated to an allowlisted review account, while ads_read uses the account with real historical delivery metrics.

ads_management

Why does the app need ads_management?

 The Contractors Marketing uses ads_management in its internal campaign workflow for advertising accounts the agency owns or has been granted access to by clients. Authorized agency operators use the app to create paused campaign drafts in the correct client account and receive an auditable creation receipt before any downstream configuration or activation. This reduces manual account switching and helps prevent campaigns from being created in the wrong account.

ads_management is necessary because creating a campaign through the Marketing API is a write operation; ads_read alone cannot perform this action.

Reviewer workflow:

1. Open https://thecontractorsmarketing.com/meta/#ads-read to confirm the connected business, labeled advertising account, and existing Spend, Impressions, Clicks, and Reach.

2. Continue within the same app to https://thecontractorsmarketing.com/meta/#ads-management.

3. Enter this private reviewer code:

[private proof access code redacted from public copy]

Then click Create PAUSED review campaign.

4. For each reviewer-initiated request, the server creates one new campaign in the fixed allowlisted account. The server controls the campaign name, objective, account, and status=PAUSED; the browser cannot supply arbitrary Meta fields or activate delivery.

5. Note the current receipt count. After creation, confirm the success receipt, the masked campaign ID returned by Meta, and the immediate exact-ID readback showing status=PAUSED and effective_status=PAUSED.

6. Confirm that the receipt count increases by one and the newest row matches the new campaign and review run. Reload immediately and confirm that the same receipt and row remain visible under Created by this app — last 1 hour.

For reviewer safety, this demonstration exercises the app's current campaign-creation functionality without creating an ad set, ad, creative, budget, targeting, placement, destination, activation, delivery, or spend.

This is a server-to-server Meta Marketing API integration using a Meta Business system user. A Meta Business administrator assigned the app and allowlisted advertising account before testing, so there is no consumer Facebook Login dialog and the reviewer does not need Business Manager credentials. The recording shows the sanitized authorization context and the complete in-app creation workflow.

Marketing API Access Tier

Why request Full Access?

 Historical July 7 submitted answer; Marketing API Access Tier is already approved and is not part of the next ads_management retry:

The Contractors Marketing API requests Marketing API Full Access so the app can reliably support legitimate production-volume Marketing API workflows for authorized agency client ad accounts. The app uses server-to-server API calls for account validation, campaign readbacks, insights reporting, and operator-authorized campaign creation. Full Access is necessary because the app is used by internal agency operators across multiple authorized business assets and ad accounts, and development-tier limits are not sufficient for that production workload.

The reviewer demo is available at

https://thecontractorsmarketing.com/meta/

It shows the Marketing API workflow, ads_read reporting proof at

https://thecontractorsmarketing.com/meta/#ads-read

 and ads_management PAUSED campaign-creation proof at

https://thecontractorsmarketing.com/meta/#ads-management

The app only works with owned or client-authorized business assets granted through Meta Business Manager. The reviewer-gated action creates only one server-controlled campaign in the allowlisted review account and forces status=PAUSED. The server reads the exact returned campaign ID back, stores it privately, and exposes only a masked ID in the sanitized receipt. Historical July 7 evidence recorded 500/500 Marketing API calls and a passing success-rate gate; that dashboard signal is operational tier evidence, not a claim about the current App Review approval status of any permission.

public_profile

If Meta asks about public_profile renewal or verification

public_profile is used only as the standard identity permission associated with Meta authorization and token validation. The Contractors Marketing API does not use public_profile to build consumer profiles, sell user data, or personalize unrelated experiences. In this server-to-server Business Manager workflow, the app uses token debug and app-scoped authorization context to confirm the token belongs to The Contractors Marketing API and that the system user has the required business, Page, and advertising scopes.

Meta form page 3

Data handling answers

processor-0

Do data processors or service providers access Platform Data?

Yes

processor-2

Listed processor or service provider

Cloudflare

Service category:
IT solutions and services, including cloud storage and processing

Processing country:
United States of America

responsible-1

Responsible person or entity

The Contractors Marketing is the legal entity responsible for all Platform Data Meta shares with this app. The app is used only by authorized internal business users/system users to manage The Contractors Marketing and client-authorized Meta advertising assets.

Country:
United States of America

requests-3/4

Public authority requests and controls

Have you provided the personal data or personal information of users to public authorities in response to national security requests in the past 12 months?
No

Policies or processes in place:
Required review of the legality of these requests.
Provisions for challenging these requests if they are considered unlawful.
Data minimization policy - the ability to disclose the minimum information necessary.
Documentation of these requests, including your responses to the requests and the legal reasoning and actors involved.

Legal URLs

Privacy, terms, and deletion URLs

Privacy Policy

https://thecontractorsmarketing.com/privacy-policy/

Terms of Service

https://thecontractorsmarketing.com/terms-of-service/

Data Deletion Instructions

https://thecontractorsmarketing.com/data-deletion/

Reviewer Demo

https://thecontractorsmarketing.com/meta/

Meta form page 4

Screencast and reviewer walkthrough copy

Overall script

Use for the main screencast description

 The screencast begins at https://thecontractorsmarketing.com/meta/ in The Contractors Marketing API reviewer console and shows the sanitized preassigned system-user authorization context. Do not open Meta App Dashboard or Business Manager. An on-screen caption explains that a Meta Business admin preassigned the app and allowlisted ad account before testing and that the system-user token is stored only on the server. The reviewer does not repeat the admin grant flow or use Meta Business credentials. Then show https://thecontractorsmarketing.com/meta/#ads-read with the connected business, labeled reporting account, Spend, Impressions, Clicks, and Reach. State that this is existing read-only advertising context and is not a request to re-review ads_read. Continue within the same TCM console to https://thecontractorsmarketing.com/meta/#ads-management.

Show the console's sanitized app identity, SYSTEM_USER token type, ads_management runtime-scope capability, connected business, allowlisted review account, and server-owned campaign policy. State that runtime scope is capability evidence, not App Review approval. Enter the private reviewer code and click Create PAUSED review campaign. Show one reviewer-initiated request producing one new campaign ID; the app immediately reads that exact ID back as status=PAUSED and effective_status=PAUSED; and a sanitized success receipt appears. Reload immediately and show the same receipt under Created by this app — last 1 hour. Explain that the immediate readback is the Meta GET and reload proves app-side receipt persistence, not another fresh Meta GET. Do not claim creation of an ad set, ad, creative, or delivery configuration.

Recording quality

Use for every uploaded screencast

 Record the next ads_management clip at 1080p or better, in English, with the browser window large enough for reviewers to read the UI. Begin in the TCM console overview with the sanitized preassigned system-user authorization context, then show the connected business, labeled reporting account, Spend, Impressions, Clicks, and Reach under ads_read before moving to ads_management. Caption the ads_read segment as existing read-only advertising context, not a request to re-review ads_read. Remain in the TCM app; do not open Meta App Dashboard or Business Manager. Use visible mouse interactions, show the page URL, and add an on-screen caption explaining that the Meta Business admin completed the system-user app and asset assignments before testing, so no public Facebook Login or reviewer grant step appears. Do not rely on audio for required context. Show one reviewer-initiated request producing one new PAUSED campaign, the sanitized receipt, the immediate exact-ID Meta readback, and the same row after an immediate reload under Created by this app — last 1 hour. Present reload as proof of durable app-side receipt persistence, not another fresh Meta GET. Do not show or claim creation of downstream ad objects or delivery configuration, and do not submit a static demo-only video.

Clip 1

business_management recording notes

 Historical July 7 business_management clip notes; not part of the next ads_management retry:

Start by showing the Business Manager/system-user grant context or a redacted App Dashboard view that explains the app is authorized through a system user rather than public Facebook Login.

Then open

https://thecontractorsmarketing.com/meta/#business-management

Show the app identity and system-user authorization context, click Refresh assets, and show the connected business portfolio, ad account, Page, and asset access table. Explain that these assets were assigned through Meta Business Manager and that business_management is used to validate the authorized business assets before any ad workflow begins.

Clip 2

pages_show_list recording notes

 Historical July 7 pages_show_list clip notes; not part of the next ads_management retry:

Open

https://thecontractorsmarketing.com/meta/#pages-show-list

Show the system-user authorization context, selected Facebook Page, masked Page ID/category/assignment context, and the Page count/readback. Explain that pages_show_list is used to list the Pages assigned to the system user through Meta Business Manager so the operator can bind the correct Page to ad identity and campaign setup. If this is uploaded as a standalone clip, repeat the caption that there is no browser OAuth dialog because this is a server-to-server system-user app.

Clip 3

pages_read_engagement recording notes

 Historical July 7 pages_read_engagement clip notes; not part of the next ads_management retry:

Open

https://thecontractorsmarketing.com/meta/#pages-read-engagement

 Show the selected Page metrics such as followers, fan count, and talking-about count. Then show the evidence row for Page metrics readback / pages_read_engagement. Explain that this read-only engagement context is used to validate Page health before campaign planning and that recent Page posts are optional context, not required for the campaign-creation workflow. If this historical permission clip is referenced, include the system-user grant caption before showing the Page metrics.

Clip 4

ads_read recording notes

 Historical July 7 ads_read clip notes; not part of the next ads_management retry:

Open

https://thecontractorsmarketing.com/meta/#ads-read

 Show the system-user authorization context, ads_read proof account, spend, impressions, clicks, reach, date range, and campaign-level insight rows. Show the historical read-only reporting evidence from the same authorized reporting account and system-user path. Explain that ads_read is used for reporting, audits, and campaign planning. If the ads_management review account is different, point out that the demo labels the split and that the creation action is restricted to its separately allowlisted account.

Clip 5

ads_management recording notes

https://thecontractorsmarketing.com/meta/#ads-read

The recording begins at https://thecontractorsmarketing.com/meta/ in the TCM reviewer console with the sanitized preassigned system-user authorization context. It then shows the connected business, labeled reporting account, Spend, Impressions, Clicks, and Reach at the ads_read URL above before moving within the same console to https://thecontractorsmarketing.com/meta/#ads-management. Explain that ads_read is existing read-only advertising context and is not a request to re-review that permission. Do not open Meta App Dashboard or Business Manager. Show the app identity, SYSTEM_USER token type, connected business, allowlisted review account, ads_management runtime-scope capability, and server-owned campaign policy. Enter the private reviewer proof code from Meta testing instructions and click Create PAUSED review campaign. Show one reviewer-initiated request producing one new PAUSED campaign, the sanitized success receipt, masked Meta campaign ID, review run, and immediate PAUSED exact-ID readback. Reload immediately and show that the same receipt remains under Created by this app — last 1 hour. Reload proves app-side receipt persistence and is not another fresh Meta GET. The clip does not claim an ad set, ad, creative, budget, targeting, placement, destination, activation, or spend.

Clip 6

Historical Marketing API Access Tier recording notes

 Historical July 7 record: the Meta App Dashboard Testing use cases evidence showed Marketing API Access Tier completed and the required success-rate gate passing. This historical clip is not the ads_management retry proof and must not be used as a substitute for the new creation recording.

Show

https://thecontractorsmarketing.com/meta/

 Evidence and Ads sections, including the live runtime checks, ads_read reporting evidence, PAUSED campaign creation receipt, exact-ID readback, Created by this app table, and audit log. Explain that dashboard tier evidence and runtime capability checks are separate from App Review permission approval.