AtlasCore Market

Walmart Legal addendum · Legal version v1 · Last updated: July 13, 2026

Walmart Marketplace API Compliance

Last updated: August 24, 2026

This addendum summarizes AtlasCore alignment with Walmart Marketplace API developer and seller agreement requirements for connected Walmart seller accounts.

Independent application status

AtlasCore is an independent software application. Walmart and related marks are trademarks of Walmart Inc. or its affiliates. AtlasCore is not sponsored, endorsed, or affiliated with Walmart.

Authentication model

AtlasCore uses the Walmart Partner REST API with per-seller credentials supplied by the authenticated user:

- Client ID and Client Secret are validated against Walmart's token endpoint (`POST /v3/token`) before storage

  • Access tokens are short-lived, refreshed automatically, and scoped to the connected seller account
  • Standard request headers include `WM_CONSUMER.ID`, `WM_CONSUMER.CHANNEL.TYPE`, and `WM_QOS.CORRELATION_ID`

AtlasCore does not scrape Seller Center, bypass API authentication, or aggregate Walmart seller data across unrelated accounts. There is no delegated OAuth consent surface and no Partner scope catalog — write access is limited to the APIs listed below.

Permitted SaaS sync operations

AtlasCore accesses Walmart Marketplace APIs only after explicit seller authorization. Permitted operations include:

- Catalog read: item metadata and SKU listings via `GET /v3/items` for dashboard visibility. Catalog and inventory access is read-only. AtlasCore does not write inventory quantities or listing content back to Walmart.

  • Order ingest: purchase-order identifiers, fulfillment status, and operational line-item snapshots (SKU and quantity) for seller workflows
  • Order acknowledge (write): `POST /v3/orders/{purchaseOrderId}/acknowledge` — the live write API. AtlasCore acknowledges newly ingested Created or Released purchase orders (seller-initiated acknowledge is also available). No shipment-create or inventory decrement API is invoked.

Rate limits & API discipline

- AtlasCore respects Walmart API rate limits and implements exponential backoff on throttled responses

  • Sync operations are scheduled and deduplicated to avoid redundant polling
  • Error responses are logged minimally for operational diagnostics

Credential security, encryption, and seller scoping

- Credential encryption: Client ID, Client Secret, access tokens, and optional webhook secrets are encrypted at rest using AES-256-GCM with the `enc:v1:` envelope format. Platform HMAC keys are not stored on merchant rows.

  • Transport: Production traffic uses TLS 1.2+ (HTTPS)
  • B2C base scope: Seller routes authenticate the signed-in user. Missing `X-Tenant` is personal scope (`tenant_id` is null). An optional workspace overlay (`X-Tenant`) binds the connected account and cached rows to that workspace; it is not required for personal accounts.
  • Isolation: Cross-user access is denied at middleware, route, and database constraint layers. Workspace overlays do not grant access to another user's Walmart rows.
  • Prohibited: screen scraping Seller Center, sharing credentials between workspaces, harvesting competitor data, or reselling Walmart API responses

Webhook verification

Inbound Walmart webhook notifications are verified using HMAC-SHA256 signature validation (consumer id + timestamp + raw body). For linked accounts, signing material is tried in this order:

1. Per-account `webhook_secret_encrypted` (optional, supplied at connect time) 2. Merchant Partner client / consumer secret 3. Platform `WALMART_WEBHOOK_SECRET` (last resort)

Unlinked ingress (unknown partner) may use the platform secret only to reject or ledger the notification. Operational order topics (`ORDER_NOTIFICATION`, `ORDER_CREATED`, `ORDER_STATUS_CHANGE`) require a declared `eventId`. Unknown event types are persisted for audit and ignored — they are not treated as order creations.

Verified events are deduplicated via a durable event ledger. Order cache rows store an allowlisted operational dictionary only (see Walmart DPP Compliance).

Seller controls

- Disconnect Walmart in AtlasCore to stop sync and purge stored credentials

See our Privacy Policy, Walmart DPP Compliance, and Disconnect Marketplace guide.