AtlasCore Market

Wayfair Legal addendum · Legal version v1 · Last updated: July 13, 2026

Wayfair Partner Home API Compliance

Last updated: August 24, 2026

This addendum summarizes AtlasCore alignment with Wayfair Partner Home API and supplier integration requirements for connected Wayfair supplier accounts.

Independent application status

AtlasCore is an independent software application. Wayfair, Wayfair LLC, and Wayfair Inc. and related marks are trademarks of Wayfair LLC / Wayfair Inc. AtlasCore is not sponsored, endorsed, or affiliated with Wayfair LLC / Wayfair Inc.

Authorized API use

AtlasCore accesses Wayfair Partner APIs only after explicit supplier authorization. Catalog and purchase-order reads run when the integration is enabled. Seller writes (inventory save and ASN shipment create) run only when `WAYFAIR_WRITE_APPROVED` is also true. Inbound webhooks never mutate stock.

AtlasCore does not scrape Wayfair Partner Home or use undocumented extraction techniques.

Data handling controls

- Credential encryption: Merchant client secrets and access tokens are encrypted at rest (AES-256-GCM). `client_id` and `supplier_id` are stored as operational identifiers

  • Transport security: Production traffic uses TLS 1.2+ (HTTPS)
  • Tenant isolation: Each AtlasCore user may link their own Wayfair supplier account; one active `supplier_id` is allowed platform-wide. Cross-user supplier access is denied at the API layer
  • Webhooks: Incoming Wayfair webhooks are HMAC-verified over the raw body before timestamp checks and JSON parse. Replay keys in `wayfair_processed_webhook_events` persist after disconnect
  • Order data: Only operational fields (PO number, status, totals, currency, dates, line SKU/qty) are stored. Buyer, ship-to, and warehouse fields are not persisted. Seller dashboard GETs return cache-only sanitized rows. Live server-side reads run for background scheduled syncs, `GET /status/` health probes, credential validation, and seller-initiated sync POSTs (`POST /sync/`, `POST /sync/catalog/`, `POST /sync/inventory/`, `POST /sync/orders/`)
  • Fulfillment responses: ASN mutations return `{handle, status}` only

Rate limits & API discipline

- AtlasCore respects Wayfair API rate limits and implements backoff on throttled responses

  • Sync jobs are batched to minimize redundant API calls
  • Failed requests are retried with exponential backoff

Seller controls

- Disconnect Wayfair in AtlasCore to stop sync and purge stored credentials

See our Privacy Policy and Disconnect Marketplace guide.