# Walmart Affiliate Marketing API > Walmart's read-only catalogue API for affiliates, documented on the Walmart I/O portal. It searches Walmart.com products and returns item details, reviews, taxonomy, trending items, recommendations and nearby stores, with affiliate links tracked through Impact. It cannot place orders. - Canonical: https://www.anchorterminal.com/tools/walmart-affiliate-api - Markdown: https://www.anchorterminal.com/tools/walmart-affiliate-api.md (~6,200 tokens) - Slim: https://www.anchorterminal.com/tools/walmart-affiliate-api.min.md (~1,280 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/walmart-affiliate-api.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-14 ## Overview **Grade E · 38.6/100 · rank #995 of 1076 · #5 in Shopping, returns & refunds · not agent-ready · confidence low** ## Assessment Live, free catalogue search and product lookup for approved Walmart affiliates, signed with an RSA key and capped at 5,000 calls a day. It cannot place or follow orders, and the Checkout API needs separate approval. The documentation renders only in a browser, and the API terms date from 2020 and still name a previous affiliate network. ## Facts | Field | Value | | --- | --- | | Vendor | Wal-Mart.com USA, LLC (Walmart Inc.) (https://walmart.io/docs/affiliates/v1/introduction) | | Kind | HTTP API | | Category | Shopping, returns & refunds (https://www.anchorterminal.com/categories/shopping) | | Transport | HTTP | | Endpoint | `https://developer.api.walmart.com/api-proxy/service/affil/product/v2` | | Auth | API key · Each request is signed. The developer creates an application on walmart.io, uploads an RSA public key and receives a consumer ID with a key version. Calls carry WM_CONSUMER.ID, WM_CONSUMER.INTIMESTAMP, WM_SEC.KEY_VERSION and WM_SEC.AUTH_SIGNATURE, a signature made with the private key that expires after 180 seconds. Sandbox and production consumer IDs are separate. Affiliate links use an Impact Radius publisher ID. | | Pricing | Free (Free) · No fee for the API was found. It is free to approved affiliates, who earn commission on referred sales. The API terms cap use at 5,000 calls a day, with higher limits on request. The 2020 terms quote 4 per cent commission, or 1 per cent on electronics, video games, films, music, books and photo goods (checked 14 October 2026). | | x402 | No · No x402, MPP or L402 in the Walmart I/O portal code, the affiliate API terms or the request headers it documents (checked 14 October 2026). | | Licence | Proprietary service under the Walmart I/O API Terms of Use (last updated 30 September 2020) | | Docs | https://walmart.io/docs/affiliates/v1/introduction | | llms.txt | not found | | Surface listed | Walmart Affiliate Marketing API v2 at developer.api.walmart.com, read from the walmart.io portal script and an unauthenticated probe on 14 October 2026 | | Endpoints | /api-proxy/service/affil/product/v2/ search, items, paginated/items, postbrowse, nbp, reviews, stores, taxonomy, trends, plus feeds (bestsellers, preorder, rollback, items), clearance and specialbuy | | Search parameters | query (required), publisherId, numItems (default 10, maximum 25), start, sort, order, responseGroup (base or full), facet (on or off) | | Authentication | RSA key pair. Consumer ID and key version issued on public key upload. Headers WM_CONSUMER.ID, WM_CONSUMER.INTIMESTAMP, WM_SEC.KEY_VERSION, WM_SEC.AUTH_SIGNATURE, signature valid 180 seconds | | Rate limit | 5,000 calls a day under the API terms. Feed API access by email request per category | | Checkout API | Separate, subscription based, needs approval and a business case. Guest checkout v2 and account linking with prepare and place order. Not graded here | | Capabilities | shopping.search, shopping.prices, shopping.affiliate | | Tags | hosted, official, affiliate, read-only, no-checkout, signed-requests | | JSON | https://www.anchorterminal.com/api/v1/tools/walmart-affiliate-api.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: low. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 33 | 6.6 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 27 | 4.4 | | Agent ergonomics | 13% | 16.2 | 57 | 9.3 | | Security & auth | 14% | 17.5 | 58 | 10.2 | | Payments & pricing | 10% | 12.5 | 25 | 3.1 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 5 | 0.4 | | Transparency & trust (editorial 34, provenance 71) | 7% | 8.8 | 53 | 4.6 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **38.6 → E** | ### Why each score - Reliability 33: No status page was found. status.walmart.io did not answer and the portal links none (0 of 20). No readable incident history, so the 5-point default (5 of 30). The API terms state 5,000 calls a day (15 of 15). The portal's response code table describes 429 as too many requests, but no Retry-After or backoff guidance was found (3 of 15). No SLA (0 of 10). The portal labels the API 'Open API' and the production endpoint answered on 14 October 2026 (10 of 10). Total 33. - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 27: No OpenAPI or machine-readable description for the affiliate API. Its specification page is marked as not a Swagger document (0 of 25). No llms.txt or Markdown, and pages render only through browser script (0 of 10). The Try API forms in the portal script describe each parameter in one line, and the prose pages for each service were not reached (8 of 20). Required and optional parameters are separated and some limits are given, such as numItems up to 25, with free-text values for others (8 of 15). Example values for each field and a table of HTTP status meanings, with no error body examples (6 of 15). The version is in the path (v2) and the live service reports version 2.0.0, with no changelog found (5 of 15). Total 27. - Agent ergonomics 57: responseGroup base or full and numItems up to 25 size responses, without field selection (15 of 25). Search pages with start and numItems, sorts with sort and order, filters by categoryId, returns facets on request, and a paginated items endpoint walks the catalogue (16 of 20). The live 403 returned JSON naming the missing security headers, and the portal maps HTTP codes to plain descriptions, with no error codes documented (8 of 20). All affiliate calls are reads and safe to retry, with no guidance written (13 of 20). Only query is required for search. There is no official SDK, and each call needs a fresh RSA signature, with Java sample code only (5 of 15). Total 57. - Security & auth 58: Requests are signed with the developer's RSA private key, which is never sent, and signatures expire after 180 seconds. A new public key can be uploaded, and sandbox and production consumer IDs are separate. There are no scopes beyond the subscribed product (22 of 30). The affiliate API only reads, so it cannot buy or change an account. Checkout sits behind a separate approval (15 of 20). Reviews and product text are written by customers and sellers, with no guidance on untrusted content (3 of 15). The portal dashboard has per-application API statistics (quick stats, top five APIs, graphs), not a per-call log (8 of 15). www.walmart.com/.well-known/security.txt points to a responsible disclosure policy with discretionary rewards and no named platform, and it has no Expires field. No certification was checked (10 of 20). Total 58. - Payments & pricing 25: No x402, MPP or L402 (0 of 40). No fee for calls is stated. The API is free to approved affiliates, and commission rates are public in the 2020 terms, so half the line (10 of 20). No card is needed, but use requires an approved affiliate account through Impact, which the affiliate site says takes about a day (15 of 20). Signup, key upload and the Impact application are browser steps for a person (0 of 20). Total 25. - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 5: No dated release, changelog or change notice for the affiliate API was found (0 of 30). No dated entries in the last 90 days (0 of 20). Support is through a support form and a Gitter room named IO-support/community in the portal code, and replies were not tested (5 of 15). No official SDK (0 of 15). No public package, repository or CI (0 of 10). Total 5. - Transparency & trust 53: Closed service with API terms shown in the portal, last updated 30 September 2020. They still name Rakuten LinkShare and MySpace while the signup form says Impact runs the programme, so they are dated and partly inconsistent with the current setup (8 of 30). The Walmart Privacy Notice, updated 20 August 2026, says data is kept as long as necessary, names Wal-Mart.com USA, LLC for Canada and Mexico, and lists vendor categories without a subprocessor list (15 of 30). The Checkout API marks its v1 and split-tender flows deprecated without dates, and no deprecation policy covers the affiliate API (3 of 20). Data is usually stored in the United States and may be processed elsewhere, India named as an example (8 of 20). Total 34. Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (16 items): https://www.anchorterminal.com/fixes/walmart-affiliate-api.md (JSON https://www.anchorterminal.com/fixes/walmart-affiliate-api.json) ### What we couldn't check - unchecked: the walmart.com Terms of Use, which answered with a bot check, including any clause on robots or automated purchases. - unchecked: the walmart.io prose pages for the introduction, quick start, additional headers, each service, item response groups and the affiliate specification. They load through browser script, and only the portal script was read. - unchecked: whether the Walmart I/O API terms dated 30 September 2020 are the current version. They name Rakuten LinkShare while the signup form names Impact. - unchecked: Checkout API access terms and who qualifies. The portal says it needs additional approval and a sound business case. - No official Walmart MCP server or public agent checkout programme was found. Walmart's appearance inside other assistants is not an interface an outside agent can call. ### Sources - walmart.io documentation shell (renders by script): (seen 2026-10-14) - walmart.io portal script with the affiliate API navigation, Try API forms, API terms and endpoints: (seen 2026-10-14) - unauthenticated probe of the search endpoint, 403 missing security headers: (seen 2026-10-14) - Walmart Affiliate Program home page: (seen 2026-10-14) - affiliates.walmart.com/apidocs, 404: (seen 2026-10-14) - Walmart Privacy Notice: (seen 2026-10-14) - responsible disclosure policy: (seen 2026-10-14) - security.txt: (seen 2026-10-14) - walmart.com robots.txt: (seen 2026-10-14) - walmart.com Terms of Use, bot check: (seen 2026-10-14) ## Who's behind it (provenance 71/100, checked 2026-10-14) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Wal-Mart.com USA, LLC | 20/20 | | Domain age | walmart.com, registered 1995-02-23 (31 years) | 15/15 | | Endpoint on the vendor's domain | developer.api.walmart.com | 15/15 | | Terms of service | read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points | 3.1/10 | | Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 | | Status page | not found | 0/10 | | Changelog | not found | 0/10 | | security.txt | valid | 10/10 | The API endpoint is developer.api.walmart.com and the documentation is on walmart.io, registered 2012-05-22. The Walmart I/O API Terms of Use (last updated 30 September 2020) are shown inside the portal with no page of their own. The walmart.com Terms of Use answered with a bot check and were not read. The privacy notice was updated 20 August 2026 and names Wal-Mart.com USA, LLC, 850 Cherry Ave., San Bruno, CA as controller for the Canada and Mexico sections. The affiliate terms give the same San Bruno address. www.walmart.com/.well-known/security.txt points to the responsible disclosure policy and has no Expires field. RDAP for walmart.com gives a registration date of 1995-02-23. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://www.walmart.com/help/article/walmart-com-terms-of-use/3b75080af40340d6bbd596f116fae5a0), read 2026-10-14, dated 2026-09-09, states 6 of the 7 things a reader expects. - To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). "…but not limited to the Inputs), as well as your purchasing history from the Walmart Sites, your use of promotions as well as personal information, may be used to further enhance and improve the Generative AI Features, the underlying model and the Walmart Sites as well as to generate Output." - To know. Restricts automated access (costs points). "or any use of data mining, robots, or similar data gathering and extraction tools is strictly prohibited." - To know. Says the terms or the service can change without notice (costs points). "Except as otherwise provided by law, at any time without notice to you, we may (1) change, restrict access to, suspend, or discontinue the Walmart Sites or any portion of the Walmart Sites" - To know. Says access can be ended without notice or for any reason. "Your account may be restricted or terminated for any reason, at our sole discretion." - To know. Requires arbitration or waives class actions. "IMPORTANT: THESE TERMS OF USE CONTAIN A MANDATORY ARBITRATION PROVISION THAT, AS FURTHER SET FORTH IN SECTION 20 BELOW, REQUIRES THE USE OF ARBITRATION ON AN INDIVIDUAL BASIS TO RESOLVE DISPUTES." - Gives the date it was last updated. Last updated 2026-09-09. - Names the governing law or courts. The law of the State of Texas. - Says how changes to the terms are announced. Changes are posted, with no other notice named. - Not found in the text. Refers to a service level or uptime commitment. - Also in the text (2026-10-14). Users may not use the Walmart Sites for any commercial purpose. "Use the Walmart Sites for any commercial purpose, or for any purpose that is fraudulent or otherwise tortious or unlawful." - Also in the text (2026-10-14). Users may not use Walmart's Materials to develop, train or improve any artificial intelligence or machine learning model without written consent. "or use any Materials to develop, train, or improve any artificial intelligence or machine learning model, tool, or technology" - Also in the text (2026-10-14). Users grant Walmart a perpetual, irrevocable, worldwide licence to use, modify and publish any Content they make available. "You grant to Walmart a royalty-free, perpetual, irrevocable, worldwide, unlimited, nonexclusive license to use, reproduce, create derivative works from, modify, publish, edit, translate, distribute, perform and display (publicly or otherwise) any Content that you make available" **Privacy policy** (https://corporate.walmart.com/privacy-security/walmart-privacy-notice), read 2026-10-14, dated 2026-08-20, states 8 of the 8 things a reader expects. - To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). "Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them, such as training our AI." - To know. Says it sells personal data or shares it for advertising. "These kinds of disclosures may be deemed selling under certain state privacy laws." - Gives the date it was last updated. Last updated 2026-08-20. - Says how long data is kept. For as long as needed, with no period named. - Gives a privacy contact. globalprivacy@wal-mart.com. - Says where data is transferred or stored. Data goes to the United States. ## Live (updated 2026-10-14 09:42 UTC) - Right now: up, HTTP 403, 538 ms, checked 2026-10-14 09:42 UTC (get on `https://developer.api.walmart.com/api-proxy/service/affil/product/v2`, asks for auth) - Uptime 24h 100.0% (17 probes) · 30 days 100.0% (17 probes) · p50 492 ms · p95 783 ms - Always current: https://www.anchorterminal.com/api/v1/live/walmart-affiliate-api.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - Read-only search, lookup by item ID or UPC, reviews, taxonomy, trending items and store lookup in one API - Request signing with an RSA private key that is never sent, and signatures that expire after 180 seconds - Separate sandbox and production consumer IDs - The daily limit of 5,000 calls is stated, with a route to ask for more ## Weaknesses - No order, cart, order status or return operation in the affiliate API - The documentation is rendered by browser script, with no OpenAPI, llms.txt or Markdown - The API terms were last updated on 30 September 2020 and name Rakuten LinkShare, not Impact - No status page, changelog or official SDK was found - The walmart.com Terms of Use answered with a bot check, so rules for automated buyers on the store were not read ## Before you call it (notes for agents) 1. Generate a fresh WM_SEC.AUTH_SIGNATURE for each call, because a signature older than 180 seconds is rejected 2. Keep below 5,000 calls a day per application 3. Pass the Impact publisher ID so returned links earn commission 4. Hand purchases to the person through the returned product link, since the affiliate API cannot check out ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Amazon Creators API | D | 48.7 | 862 | shopping.search, shopping.prices, shopping.affiliate | no | https://www.anchorterminal.com/tools/amazon-creators-api.md | | Etsy Open API v3 | B | 63.4 | 421 | shopping.search, shopping.prices | no | https://www.anchorterminal.com/tools/etsy.md | | Best Buy Developer API | E | 39.1 | 991 | shopping.search, shopping.prices | no | https://www.anchorterminal.com/tools/best-buy.md | | Instacart Developer Platform API + MCP | D | 48.3 | 877 | shopping.affiliate | no | https://www.anchorterminal.com/tools/instacart.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The portal labels the Affiliate Marketing API 'Open API' and lists Catalog Product, Post Browsed Products, Product Lookup, Product Recommendation, Reviews, Search, Stores, Taxonomy and Trending Items (walmart.io portal script, https://walmart.io/docs/affiliates/v1/introduction) - The production search endpoint answered 403 with 'Request is missing required security headers' and service name affil-product, version 2.0.0, so the service is live (source: ) - A separate Checkout API (guest checkout v2 and account linking with prepare and place order) is labelled 'Subscription Based' and needs additional approval and a business case. It is not graded here (walmart.io portal script) - The API terms, last updated 30 September 2020, allow use only to advertise Walmart.com products, bar competitors from using it for pricing analysis, cap use at 5,000 calls a day and still name Rakuten LinkShare, while the signup form says Impact runs the affiliate programme - walmart.io renders its documentation in the browser from a script. The page text was read from that script, not from rendered pages, and the prose for introduction, quick start and each service was not reached - No official Walmart MCP server or public agent checkout programme was found. Walmart's developer.walmart.com APIs serve marketplace sellers, suppliers and advertisers - #5 of 5 in Best shopping and order APIs for AI agents buying for a person: https://www.anchorterminal.com/best/shopping/index.md - All 8 shopping comparisons: https://www.anchorterminal.com/compare/shopping/index.md ## Compare - [Amazon Creators API vs Walmart Affiliate Marketing API](https://www.anchorterminal.com/compare/amazon-creators-api-vs-walmart-affiliate-api.md): D 48.7 vs E 38.6 - [Best Buy Developer API vs Walmart Affiliate Marketing API](https://www.anchorterminal.com/compare/best-buy-vs-walmart-affiliate-api.md): E 39.1 vs E 38.6 - [Etsy Open API v3 vs Walmart Affiliate Marketing API](https://www.anchorterminal.com/compare/etsy-vs-walmart-affiliate-api.md): B 63.4 vs E 38.6 - [Instacart Developer Platform API + MCP vs Walmart Affiliate Marketing API](https://www.anchorterminal.com/compare/instacart-vs-walmart-affiliate-api.md): D 48.3 vs E 38.6 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on walmart.com or walmart.io or one of their subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "walmart-affiliate-api", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html Walmart Affiliate Marketing API on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![Walmart Affiliate Marketing API on Anchor Terminal](https://www.anchorterminal.com/badges/walmart-affiliate-api.svg)](https://www.anchorterminal.com/tools/walmart-affiliate-api) ``` Plain link: ```html Walmart Affiliate Marketing API on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Walmart Affiliate Marketing API is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/walmart-affiliate-api-dark.png - Light: https://www.anchorterminal.com/assets/share/walmart-affiliate-api-light.png - Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=walmart-affiliate-api