AtlasCore Market

eBay Legal addendum · Legal version v1 · Last updated: July 13, 2026

eBay API Compliance

Last updated: August 24, 2026

This addendum summarizes AtlasCore alignment with eBay Developer Program requirements for connected eBay seller accounts.

Independent application status

AtlasCore is an independent software application. eBay and related marks are trademarks of eBay Inc. AtlasCore is not sponsored, endorsed, or affiliated with eBay.

Authorized API use

AtlasCore accesses eBay APIs only after explicit seller OAuth consent. Requested scopes include inventory, fulfillment, account, and Commerce Notification subscription where authorized.

Active write APIs used after consent:

- `sell.inventory`: inventory item PUT, offer create, and offer publish

  • `sell.fulfillment`: shipping fulfillment create and order reads

Inventory quantity decrements run at most once per order and only on `MARKETPLACE_CHECKOUT_ORDER_PAYMENT_CONFIRMED`. Order-closed notifications refresh order state and do not decrement inventory.

Data handling controls

- Token encryption: OAuth access and refresh tokens are encrypted at rest (AES-256-GCM).

  • Transport security: Production traffic uses TLS 1.2+.
  • Seller (B2C) isolation: Each AtlasCore user may link their own eBay seller account; cross-user access is denied at the API layer. A workspace overlay applies only when a request supplies `X-Tenant`.
  • Webhooks: Incoming eBay notifications are signature-verified before processing. Checkout and order events persist an allowlisted operational dictionary (`notificationId`, `event_type`, `orderId`, SKUs) rather than raw unrestricted JSON. Operational checkout processing requires a declared `notificationId`.
  • Order PII: Buyer and shipping fields default to masked responses. Unmasked PII requires an explicit `include_pii=true` request by an authorized role. Retention is 30 days after fulfillment (`fulfilled_at` on `FULFILLED` orders) and a 90-day ceiling for unfulfilled orders.

Seller controls

- Disconnect eBay in AtlasCore to stop sync and purge stored credentials.

See our Privacy Policy and Disconnect Marketplace guide.