Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (7)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Shopify ↗ | 7.7* | 5.8* |
| Amazon Seller Central ↗ | 6.4* | 5.4* |
| TikTok Shop ↗ | 6.7* | 3.7* |
| BigCommerce ↗ | 7.1* | 4.6* |
| Adobe Commerce / Magento ↗ | 7.6* | 4.6* |
| WooCommerce ↗ | 8.2* | 5.7* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Merchant-controlled stores and marketplace seller APIs have different approval and entitlement rules. Each finding retains the reviewed route and object scope.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Shopify
Ecommerce · Checked 2026-10-17
Shopify / one-merchant custom-distribution app using the GraphQL Admin API for ordinary authorized store operations. This grade excludes reusable public-app distribution and applications primarily transferring Merchant Data to third parties.
Read findings and sources ↗Amazon Seller Central
Ecommerce · Checked 2026-10-12
Amazon Selling Partner API / Professional seller private application, reports and listing operations. Public apps and restricted personal-data roles have additional reviews.
Read findings and sources ↗| Customer control | Shopify ↗ | Amazon Seller Central ↗ | TikTok Shop ↗ | BigCommerce ↗ | Adobe Commerce / Magento ↗ | WooCommerce ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|
| Category | Ecommerce | Ecommerce | Ecommerce | Ecommerce | Ecommerce | Ecommerce | Databases and data platforms |
| Overall control | |||||||
| Data access | |||||||
| Third-party accessibility | |||||||
| External action | |||||||
| Continuity | |||||||
| Data exit | |||||||
| Business logic and customization | |||||||
| Assessment scope | Shopify / one-merchant custom-distribution app using the GraphQL Admin API for ordinary authorized store operations. This grade excludes reusable public-app distribution and applications primarily transferring Merchant Data to third parties. | Amazon Selling Partner API / Professional seller private application, reports and listing operations. Public apps and restricted personal-data roles have additional reviews. | TikTok Shop / System Integrator/custom Connector app, seller authorization and Finance API. Own-shop Seller Developer eligibility is not assumed for third-party-operated apps. | BigCommerce single-store API accounts for REST catalog products and supported store webhooks; app-level OAuth distribution and account-level administration are distinct routes. | Adobe Commerce PaaS and Magento Open Source merchant-authorized REST interfaces; Adobe Commerce I/O Events journaling is a separate configured route, not assumed for Magento Open Source or Commerce SaaS. | Merchant-controlled WooCommerce REST API v3 order resources and core webhooks; hosting, plugins and WordPress database backup are separate operational boundaries. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-17 | 2026-10-12 | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Shopify ↗
A one-merchant custom app supports useful store access. Public connectors face a separate regime of app review, Shopify billing and revenue share; data-transfer and migration applications also face purpose restrictions.
Shopify / one-merchant custom-distribution app using the GraphQL Admin API for ordinary authorized store operations. This grade excludes reusable public-app distribution and applications primarily transferring Merchant Data to third parties.
Amazon Seller Central ↗
Private SP-API apps avoid public listing, but require a Professional seller account and approved roles. Historical fee announcements should not be treated as current charges.
Amazon Selling Partner API / Professional seller private application, reports and listing operations. Public apps and restricted personal-data roles have additional reviews.
TikTok Shop ↗
TikTok Shop finance access depends on developer type, market and app review. Settlement endpoints also expose different historical windows.
TikTok Shop / System Integrator/custom Connector app, seller authorization and Finance API. Own-shop Seller Developer eligibility is not assumed for third-party-operated apps.
BigCommerce ↗
BigCommerce lets merchants create scoped store API accounts for manual third-party connections. REST catalog APIs support external product reads and writes; webhook delivery has a bounded retry period.
BigCommerce single-store API accounts for REST catalog products and supported store webhooks; app-level OAuth distribution and account-level administration are distinct routes.
Adobe Commerce / Magento ↗
Adobe Commerce and Magento Open Source expose merchant-authorized REST interfaces with search criteria. Configured Adobe Commerce I/O Events can add seven-day event journaling, with separate entitlement and setup checks.
Adobe Commerce PaaS and Magento Open Source merchant-authorized REST interfaces; Adobe Commerce I/O Events journaling is a separate configured route, not assumed for Magento Open Source or Commerce SaaS.
WooCommerce ↗
WooCommerce uses merchant-generated REST keys linked to WordPress user permissions. Its v3 API supports structured order extraction and writes, while core webhooks need reconciliation after delivery failures.
Merchant-controlled WooCommerce REST API v3 order resources and core webhooks; hosting, plugins and WordPress database backup are separate operational boundaries.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.