# Walmart Marketplace API Compliance

**Last updated:** August 24, 2026

This addendum summarizes AtlasCore alignment with Walmart Marketplace API developer and seller agreement requirements for connected Walmart seller accounts.

## Independent application status

AtlasCore is an independent software application. **Walmart** and related marks are trademarks of Walmart Inc. or its affiliates. AtlasCore is not sponsored, endorsed, or affiliated with Walmart.

## Authentication model

AtlasCore uses the **Walmart Partner REST API** with per-seller credentials supplied by the authenticated user:

- **Client ID** and **Client Secret** are validated against Walmart's token endpoint (`POST /v3/token`) before storage
- Access tokens are short-lived, refreshed automatically, and scoped to the connected seller account
- Standard request headers include `WM_CONSUMER.ID`, `WM_CONSUMER.CHANNEL.TYPE`, and `WM_QOS.CORRELATION_ID`

AtlasCore does **not** scrape Seller Center, bypass API authentication, or aggregate Walmart seller data across unrelated accounts. There is no delegated OAuth consent surface and no Partner scope catalog — write access is limited to the APIs listed below.

## Permitted SaaS sync operations

AtlasCore accesses Walmart Marketplace APIs only after explicit seller authorization. Permitted operations include:

- **Catalog read:** item metadata and SKU listings via `GET /v3/items` for dashboard visibility. Catalog and inventory access is **read-only**. AtlasCore does not write inventory quantities or listing content back to Walmart.
- **Order ingest:** purchase-order identifiers, fulfillment status, and operational line-item snapshots (SKU and quantity) for seller workflows
- **Order acknowledge (write):** `POST /v3/orders/{purchaseOrderId}/acknowledge` — the live write API. AtlasCore acknowledges newly ingested Created or Released purchase orders (seller-initiated acknowledge is also available). No shipment-create or inventory decrement API is invoked.

## Rate limits & API discipline

- AtlasCore respects Walmart API rate limits and implements exponential backoff on throttled responses
- Sync operations are scheduled and deduplicated to avoid redundant polling
- Error responses are logged minimally for operational diagnostics

## Credential security, encryption, and seller scoping

- **Credential encryption:** Client ID, Client Secret, access tokens, and optional webhook secrets are encrypted at rest using AES-256-GCM with the `enc:v1:` envelope format. Platform HMAC keys are **not** stored on merchant rows.
- **Transport:** Production traffic uses TLS 1.2+ (HTTPS)
- **B2C base scope:** Seller routes authenticate the signed-in user. Missing `X-Tenant` is personal scope (`tenant_id` is null). An optional workspace overlay (`X-Tenant`) binds the connected account and cached rows to that workspace; it is not required for personal accounts.
- **Isolation:** Cross-user access is denied at middleware, route, and database constraint layers. Workspace overlays do not grant access to another user's Walmart rows.
- **Prohibited:** screen scraping Seller Center, sharing credentials between workspaces, harvesting competitor data, or reselling Walmart API responses

## Webhook verification

Inbound Walmart webhook notifications are verified using HMAC-SHA256 signature validation (consumer id + timestamp + raw body). For **linked** accounts, signing material is tried in this order:

1. Per-account `webhook_secret_encrypted` (optional, supplied at connect time)
2. Merchant Partner client / consumer secret
3. Platform `WALMART_WEBHOOK_SECRET` (last resort)

Unlinked ingress (unknown partner) may use the platform secret only to reject or ledger the notification. Operational order topics (`ORDER_NOTIFICATION`, `ORDER_CREATED`, `ORDER_STATUS_CHANGE`) require a declared `eventId`. Unknown event types are persisted for audit and ignored — they are not treated as order creations.

Verified events are deduplicated via a durable event ledger. Order cache rows store an allowlisted operational dictionary only (see [Walmart DPP Compliance](/legal/walmart/walmart-dpp-compliance.md)).

## Seller controls

- Disconnect Walmart in AtlasCore to stop sync and purge stored credentials
- Revoke API or app access in Walmart Seller Center as needed
- Contact [privacy@atlascore-market.com](mailto:privacy@atlascore-market.com) for data subject requests

See our [Privacy Policy](/legal/privacy), [Walmart DPP Compliance](/legal/walmart/walmart-dpp-compliance.md), and [Disconnect Marketplace](/legal/disconnect-marketplace) guide.