AtlasCore Market

Magento / Adobe Commerce Legal addendum · Legal version v1 · Last updated: July 13, 2026

Magento / Adobe Commerce API Compliance

Last updated: August 24, 2026

This addendum summarizes AtlasCore alignment with Magento / Adobe Commerce developer and merchant agreement requirements for connected stores.

Independent application status

AtlasCore is an independent software application. Magento, Adobe Commerce, and related marks are trademarks of Adobe Inc. or its affiliates. AtlasCore is not sponsored, endorsed, or affiliated with Adobe or Magento.

Authorized API use

AtlasCore accesses a Magento store only after explicit merchant authorization. Integration Bearer tokens are the standard authentication mechanism. Optional admin credential exchange generates a session-scoped Magento admin token; AtlasCore stores only the resulting Bearer token. Live server-side reads are focused on order synchronization and connection health validation. Seller writes (inventory update) run only when `MAGENTO_WRITE_APPROVED` is also true. Inbound webhooks never mutate stock.

AtlasCore does not scrape the Magento Admin panel or use undocumented data extraction methods. AtlasCore uses REST API v1 only; GraphQL is not used by this integration. Catalog listing sync is not a primary Magento spoke surface; order ingest and optional inventory writes are the supported integration scope.

Data handling controls

- Credential encryption: Integration tokens, store URLs, and optional webhook secrets are encrypted at rest (AES-256-GCM, `enc:v1:` prefix)

  • Transport security: Production traffic uses TLS 1.2+ (HTTPS)
  • Tenant isolation: Each AtlasCore user may link their own Magento store; one active `store_hash` is allowed platform-wide. Cross-user store access is denied at the API layer
  • Webhooks: Incoming Magento webhooks require the AtlasCore HMAC-SHA256 header standard (`X-Magento-Signature`) over the raw request body before timestamp evaluation, event persistence or dispatch. A dedicated webhook secret is required — integration bearer tokens are never used as HMAC material. A bounded parse may run after HMAC authenticity solely to bind the verified store ID. Replay keys persist after disconnect in `magento_processed_webhook_events` only — there is no inventory adjustment ledger
  • Order data: Only operational fields (entity/increment id, status, totals, dates, line SKU/qty) are stored. Customer, shipping, billing, and contact fields are not persisted. Seller dashboard GETs return cache-only sanitized rows. Live server-side reads run strictly for seller-initiated sync POSTs (`POST /sync/`), `GET /status/` health probes, and credential validation

Rate limits & API discipline

- AtlasCore respects Magento API rate limits and implements backoff on throttled responses

  • Sync jobs are batched to minimize redundant API calls
  • Failed requests are retried with exponential backoff

Seller controls

- Disconnect Magento in AtlasCore to stop sync and purge stored credentials

  • Revoke or delete the AtlasCore integration in Magento Admin → System → Integrations
  • Contact privacy@atlascore-market.com for data subject requests

See our Privacy Policy and Disconnect Marketplace guide.