Marketplace API & Browser Automation Compliance

eBay Official API risk: low

baseline: disabled

Prerequisites: Seller OAuth + Inventory Location + Fulfillment/Payment/Return policy IDs

Compliance Rule: Uses official eBay Inventory API (upsert item -> create offer -> publish) and Notification API with separate Application vs User OAuth token class verification.

Etsy Official API risk: low

baseline: disabled

Prerequisites: Etsy Open API v3 PKCE OAuth + Handmade/Vintage (>=20 yr) Eligibility Artifact

Compliance Rule: Strict Etsy Open API v3 guard: general resale cannot silently become handmade, and vintage items require verified >= 20-year evidence before request construction.

Poshmark Isolated Browser risk: high

baseline: disabled

Prerequisites: Explicit Owner Browser-Risk Mandate + Persistent Profile Session

Compliance Rule: Runs through GuardedBrowserConnectorRuntime with post-submit reconciliation. Halts immediately for owner recovery on CAPTCHA, MFA, or account challenge.

Mercari Isolated Browser risk: high

baseline: disabled

Prerequisites: Explicit Owner Browser-Risk Mandate + Persistent Profile Session

Compliance Rule: Fenced browser effect execution with idempotency replay detection; never bypasses security or verification prompts.

Depop Partner API risk: medium

baseline: partner_required

Prerequisites: Signed Partner Approval Artifact + Depop Selling API OAuth Scopes

Compliance Rule: Requires cryptographically signed, time-bounded partner approval artifact validated against PostgreSQL CURRENT_TIMESTAMP before SKU upsert.

Shopify Official API risk: low

baseline: disabled

Prerequisites: Shop Domain + Admin GraphQL 2026-07 Token + Publication & Location IDs

Compliance Rule: Owned store channel using versioned 2026-07 Admin GraphQL productSet and explicit publication/unpublication.

Facebook Marketplace Partner API risk: medium

baseline: partner_required

Prerequisites: Signed Meta Partner Artifact OR Separate Owner Browser-Risk Mandate

Compliance Rule: Artifact-driven partner boundary (exact HTTPS endpoint + method per operation) or explicitly authorized isolated browser session. Never guesses private endpoints.

OfferUp Isolated Browser risk: high

baseline: disabled

Prerequisites: Explicit Owner Browser-Risk Mandate + Local Handoff Policy

Compliance Rule: Guarded browser automation with coarse-to-exact location handoff gating.

Craigslist Isolated Browser risk: high

baseline: disabled

Prerequisites: Explicit Owner Browser-Risk Mandate + Local Handoff Policy

Compliance Rule: Guarded browser manifest driver; zero automated bypass of verification challenges.