generated: '2026-08-30'
method: searched
source: >-
  https://www.acehardware-vendors.com/Vendors%20Public/Documents/Ace%20Vendor%20Manual.pdf
  and https://www.acehardware.com/affiliates
docs: https://www.acehardware-vendors.com/
provider: Ace Hardware
providerId: ace-hardware
description: >-
  Authentication profile for Ace Hardware's integration surfaces. There is no OpenAPI
  securitySchemes block to derive from — Ace Hardware publishes no HTTP API — so this profile is
  searched from the provider's vendor documentation and affiliate program pages. The controlling
  credential on the machine-to-machine surface is an X.509 certificate used for AS2 message
  signing and encryption, not an API key or a bearer token.
note: >-
  derive-authentication.py was not applicable here: it reads openapi/ and this repo has no
  OpenAPI document because the provider publishes none.

schemes:
  - id: as2-certificate
    type: mutualTLS
    subtype: as2-message-level-certificate
    surface: Ace Hardware Vendor EDI Integration
    description: >-
      Vendors exchange X12 documents with Ace Hardware over AS2 (HTTP or HTTPS). Authentication
      and encryption are provided by exchanged X.509 certificates; Ace states a preference for
      SHA2. Certificates are swapped during trading-partner setup along with the AS2 identifiers,
      so credential issuance is a manual onboarding step, not a self-service key.
    credential: X.509 certificate pair exchanged during trading-partner setup
    signature_algorithm_preference: SHA2
    identifiers:
      - environment: stage
        edi_id: ZZ/7089906600
      - environment: production
        edi_id: 01/006928311
    self_service: false
    evidence: >-
      "Ace Hardware offers data exchange over the internet using AS2 HTTP or HTTP/HTTPS with
      authentication and encryption provided via certificate (preferred being SHA2)."
  - id: vendor-portal-login
    type: http
    subtype: session-login
    surface: AceHardware-Vendors.com vendor portal
    description: >-
      The vendor portal at www.acehardware-vendors.com serves a public documents area (the Ace
      Vendor Manual and forms are readable anonymously) behind which vendor-specific functions
      require a portal account issued by Ace Hardware. No public registration path exists.
    self_service: false
    evidence: 'https://www.acehardware-vendors.com/ returned 200 with a public Vendors Public documents area and a login for vendor-specific functions (probed 2026-08-30).'
  - id: impact-affiliate-account
    type: delegated
    subtype: third-party-network-account
    surface: Ace Hardware Affiliate Program
    description: >-
      The affiliate program is operated on the Impact partner network. Tracking links, banners
      and reporting are accessed with an Impact media-partner account, not with an Ace Hardware
      credential. Any programmatic access to affiliate reporting is Impact's API under Impact's
      own credentials — Ace Hardware issues no affiliate API key.
    self_service: true
    signup: 'https://app.impact.com/campaign-mediapartner-signup/Ace-Hardware.brand?type=dm'
    evidence: 'https://www.acehardware.com/affiliates states "You can find reporting, links, and banners at Impact!" and links the media-partner signup.'

absent:
  - scheme: apiKey
    note: No API key issuance, no key prefix, and no key management surface is documented.
  - scheme: oauth2
    note: '/.well-known/oauth-authorization-server returned 500 (empty) on www.acehardware.com and 404 on www.acehardware-vendors.com.'
  - scheme: openIdConnect
    note: '/.well-known/openid-configuration returned 500 (empty) on www.acehardware.com and 404 on www.acehardware-vendors.com.'
  - scheme: bearer
    note: No token endpoint or bearer-token documentation exists on either host.

maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com