AtlasCore Market

Faire Wholesale Legal addendum · Legal version v1 · Last updated: July 13, 2026

Faire API Compliance

Last updated: August 22, 2026

This addendum summarizes AtlasCore alignment with Faire Open API developer and brand portal requirements for connected Faire brand accounts.

Independent application status

AtlasCore is an independent software application. Faire and related marks are trademarks of Faire Wholesale, Inc. or its affiliates. AtlasCore is not sponsored, endorsed, or affiliated with Faire.

Authorized OAuth scopes

AtlasCore requests the following Faire scopes when a seller connects their brand:

- `READ_ORDERS` — wholesale order ingest for seller operational workflows

  • `READ_PRODUCTS` — catalog sync for dashboard visibility
  • `READ_BRAND` — brand identifier for account binding
  • `READ_INVENTORIES` / `WRITE_INVENTORIES` — availability reads and one-time inventory decrements on new orders
  • `READ_SHIPMENTS` / `WRITE_SHIPMENTS` — shipment status reads and seller-initiated tracking submissions

Seller routes remain disabled (`FAIRE_INTEGRATION_ENABLED=false`) until the Faire partner portal is configured. Inventory PATCH and shipment POST additionally require `FAIRE_WRITE_SCOPES_APPROVED=true`. AtlasCore requests `WRITE_INVENTORIES` / `WRITE_SHIPMENTS` only when both flags are enabled. AtlasCore does not scrape the Faire brand portal or access data outside authorized API scopes.

Permitted SaaS sync operations

AtlasCore accesses Faire APIs only after explicit brand authorization. Permitted operations include:

- Catalog sync: product listings, variant metadata, and catalog snapshots for dashboard visibility

  • Order ingest: wholesale order data and fulfillment status for seller operational workflows
  • Inventory updates: on-hand quantity decrements for new wholesale orders, applied once per order line
  • Shipment writes: tracking submissions for cached orders owned by the connected brand

Rate limits & API discipline

- AtlasCore respects Faire API rate limits and implements backoff on throttled responses

  • Sync jobs are batched to minimize redundant requests
  • Webhook notifications are persisted and deduplicated by `event_id` (or a body hash) before processing
  • Connection health probes are cached for several minutes to avoid redundant live calls

Credential security & prohibited practices

- Token encryption: OAuth access tokens are encrypted at rest (AES-256-GCM). AtlasCore does not receive or store Faire refresh tokens.

  • App credentials: Platform `FAIRE_APP_ID` / `FAIRE_APP_SECRET` are resolved from the server environment at request time and are not written on new connects; legacy secrets purged via migration; columns remain unused
  • Transport: Production traffic uses TLS 1.2+ (HTTPS)
  • Brand uniqueness: An active `brand_id` may be claimed by only one AtlasCore account per environment
  • Tenant isolation: Each AtlasCore user links their own Faire brand account; cross-user access is denied
  • Prohibited: screen scraping, credential sharing, aggregating Faire data across unrelated brands, or reselling API responses

Seller controls

- Disconnect Faire in AtlasCore to stop sync and purge stored credentials for that account

See our Privacy Policy and Disconnect Marketplace guide.