Running the Platform Glossary · Commerce

Access scope: the permission an app is granted on a merchant's data, such as Shopify's read_orders and write_orders, requested at the narrowest level the app needs (Store Security & PCI).
AI content label: machine-readable marking that an image or text was generated, such as the IPTC TrainedAlgorithmicMedia source type Google Merchant Center requires on generated product images (AI in Commerce).
API extension (synchronous): a call from the platform to the merchant's endpoint before a change is saved, which can validate or modify it within a timeout, such as commercetools' 2 seconds by default (Commerce Architecture).
Average order value (AOV): net merchandise revenue over orders, computed per channel, excluding shipping and tax unless named gross (Commerce Metrics).
BOTS Act: the 2016 federal law against circumventing ticket issuers' purchase limits and reselling tickets so bought; it covers event tickets only (Commerce Fraud & Abuse).
Bounded context: a part of the system that owns its tables, vocabulary and invariants, reached by others only through its interface and events, such as inventory or orders (Commerce Architecture).
Bulk operation: an asynchronous job that runs a large query or mutation and returns a file, such as Shopify's JSONL results at a URL that expires after a week (Commerce Architecture).
Card testing: running many small payment attempts through a checkout or card setup to learn which stolen cards are live; it raises the decline rate for real customers (Commerce Fraud & Abuse).
Cart abandonment rate: the share of carts with at least one line that don't become an order within a stated window; Baymard's cross-study average is 70.22% (Commerce Metrics).
Cashing out: spending a taken-over account's stored value (saved card, points, store credit, gift card balance), the step account takeover exists for (Commerce Fraud & Abuse).
Clearing account: a ledger account per payment source that orders, refunds, fees and payouts move through, which reconciliation proves clears to zero (Commerce Accounting).
Code freeze (change freeze): a window before peak in which only critical, reversible changes ship; Salesforce B2C Commerce customers typically freeze on November 1 (Peak Season & Drops).
Collaborator account: outside admin access for an agency or developer, requested with a code, scoped, and expiring after inactivity, as on Shopify (Store Security & PCI).
Compelling Evidence 3.0: Visa's 2023 rule letting a merchant defeat a fraud dispute with two earlier undisputed transactions on the same card that match on device or IP and one more data element (Commerce Fraud & Abuse).
Conversion rate: human sessions with at least one order over human sessions; Shopify's is "the percentage of sessions that resulted in a purchase" (Commerce Metrics).
Cost layer: units received at one landed cost, drawn by shipments and write-offs in FIFO or average order to compute cost of goods sold (Commerce Accounting).
Credential stuffing: logging in with username and password pairs leaked elsewhere, at scale; the usual route to store account takeover (Commerce Fraud & Abuse).
Crosswalk (record mapping): the row that says this order, item or refund here is that record in another system, with both sides' versions (ERP & Integrations).
Customer deposit: money captured before goods ship, held as a liability and applied to the invoice or sale at fulfillment (Commerce Accounting).
Cutover (replatforming): the window in which the old store stops selling and the new one starts: final delta, old billing paused, traffic switched, balances reconciled (Replatforming & Migration).
Daily summary posting: sending a day's orders to the ERP as one journal entry by account and channel instead of order by order (ERP & Integrations).
Days of supply: units on hand over average daily units sold in the trailing 28 days (Commerce Metrics).
Demand surcharge (peak surcharge): a carrier's per-package charge for the holiday season, such as FedEx's residential surcharge from late October to mid-January (Peak Season & Drops).
Denial of inventory: bots holding stock in carts or reservations without buying, so nobody else can (OWASP OAT-021) (Commerce Fraud & Abuse).
Draw: a drop in which shoppers enter during a window and winners are chosen at random, with a recorded seed and rank per entry (Peak Season & Drops).
Drop (limited release): a scheduled release of scarce stock, with its own allocation, hold time, purchase limit and published rules (Peak Season & Drops).
ERP (enterprise resource planning): the system holding the general ledger, item master and costs, purchasing, receivables on terms and the close, such as NetSuite or Business Central (ERP & Integrations).
E-skimming (Magecart): script added to a store's payment page that copies card details as shoppers type them and sends them elsewhere (Store Security & PCI).
Evaluation set: fixed real cases, with human-checked labels, that a model or prompt change must pass before release (AI in Commerce).
Featured Offer share: hours a seller held the Featured Offer on a listing over hours the listing was active; Amazon's own percentage weights by page views (Commerce Metrics).
Field ownership: which system may write which group of an object's fields, such as cost from the ERP and description from the PIM (ERP & Integrations).
Fill rate (order): units shipped over units ordered on orders due in a period, cancellations for stock counting as unfilled (Commerce Metrics).
Friendly fraud (first-party misuse): a real cardholder disputing a purchase they made or authorized (Commerce Fraud & Abuse).
Function (sandboxed): merchant or app code that runs inside the platform's checkout with fixed instruction and memory limits and no network access, such as a Shopify Function (Commerce Architecture).
GMROI: gross margin dollars over twelve months divided by average inventory at cost (Commerce Metrics).
Inventory turns: cost of goods sold over twelve months divided by average month-end inventory at cost (Commerce Metrics).
iPaaS: a hosted integration platform for flows between systems, with connectors, mapping and error queues, such as Celigo, Boomi or MuleSoft (ERP & Integrations).
Isolated security patch: a fix for one vulnerability applied without a full upgrade, which Adobe ships monthly for Adobe Commerce (Store Security & PCI).
Metric value (frozen): a computed metric for a period under one definition version, frozen when reported and restated only by a superseding row (Commerce Metrics).
MRR (product subscriptions): the next renewal's merchandise value of every active subscription normalized to a month; a run-rate, not revenue (Commerce Metrics).
On-time ship rate: orders shipped by the ship-by date of their stored promise over orders shipped (Commerce Metrics).
Order pipeline: the order's one synchronous write (order and event together) followed by every other context reacting to its events (Commerce Architecture).
Payment page script inventory: the list of every script on a payment page with its justification and integrity method, required by PCI DSS 6.4.3 (Store Security & PCI).
Pod (tenant shard): a set of merchants on their own isolated datastores, routed to at the edge, as Shopify scales its shops (Commerce Architecture).
Pre-queue: a waiting room that opens before a sale and admits everyone present in random order at the start (Peak Season & Drops).
Principal versus agent: whether a seller controls goods before they transfer and books gross revenue, or arranges the sale and books its fee (Commerce Accounting).
Repeat purchase rate: the share of a first-order cohort that orders again within a stated number of days (Commerce Metrics).
Retail inventory method: valuing inventory from retail prices and a cost-to-retail ratio, often combined with LIFO by large US retailers (Commerce Accounting).
Return rate (by order month): units on received returns over units shipped, assigned to the month of the order and provisional until the return window closes (Commerce Metrics).
Returns reserve: the refund liability and return asset booked for sales still expected to come back, estimated from return history (Commerce Accounting).
SAQ A script criterion: the 2025 eligibility condition that a merchant embedding a provider's payment form confirm its site resists script attacks, by its own controls or the provider's written confirmation (Store Security & PCI).
Scalping: buying limited goods by unfair automated means to resell them (OWASP OAT-005) (Commerce Fraud & Abuse).
Shipping and handling election: the US GAAP choice to treat shipping after control passes as a fulfillment cost rather than a separate service (Commerce Accounting).
Sign-in password migration: importing customers with their old hash kept aside, verifying it at first sign-in and then setting the password natively, since hashes don't move between platforms (Replatforming & Migration).
Subresource Integrity (SRI): a hash on a script tag that makes the browser refuse the file if its bytes change (Store Security & PCI).
Tamper detection (PCI DSS 11.6.1): checking a payment page's scripts and security headers as the browser receives them, at least weekly by default, and alerting on unauthorized change (Store Security & PCI).
Token migration (replatforming): moving stored payment methods processor to processor or into a new platform's gateway, returning a mapping file of old to new IDs (Replatforming & Migration).
Units per order (UPT): units on top-level order lines over orders, bundles counted once (Commerce Metrics).
Waiting room: a gate that admits shoppers at the rate checkout can serve, with a signed token checked again at checkout (Peak Season & Drops).
Webhook delivery: one event sent to one subscriber, retried until acknowledged and deduplicated by the event ID (Commerce Architecture).

Access scope: the permission an app is granted on a merchant's data, such as Shopify's read_orders and write_orders, requested at the narrowest level the app needs (Store Security & PCI).
AI content label: machine-readable marking that an image or text was generated, such as the IPTC TrainedAlgorithmicMedia source type Google Merchant Center requires on generated product images (AI in Commerce).
API extension (synchronous): a call from the platform to the merchant's endpoint before a change is saved, which can validate or modify it within a timeout, such as commercetools' 2 seconds by default (Commerce Architecture).
Average order value (AOV): net merchandise revenue over orders, computed per channel, excluding shipping and tax unless named gross (Commerce Metrics).
BOTS Act: the 2016 federal law against circumventing ticket issuers' purchase limits and reselling tickets so bought; it covers event tickets only (Commerce Fraud & Abuse).
Bounded context: a part of the system that owns its tables, vocabulary and invariants, reached by others only through its interface and events, such as inventory or orders (Commerce Architecture).
Bulk operation: an asynchronous job that runs a large query or mutation and returns a file, such as Shopify's JSONL results at a URL that expires after a week (Commerce Architecture).
Card testing: running many small payment attempts through a checkout or card setup to learn which stolen cards are live; it raises the decline rate for real customers (Commerce Fraud & Abuse).
Cart abandonment rate: the share of carts with at least one line that don't become an order within a stated window; Baymard's cross-study average is 70.22% (Commerce Metrics).
Cashing out: spending a taken-over account's stored value (saved card, points, store credit, gift card balance), the step account takeover exists for (Commerce Fraud & Abuse).
Clearing account: a ledger account per payment source that orders, refunds, fees and payouts move through, which reconciliation proves clears to zero (Commerce Accounting).
Code freeze (change freeze): a window before peak in which only critical, reversible changes ship; Salesforce B2C Commerce customers typically freeze on November 1 (Peak Season & Drops).
Collaborator account: outside admin access for an agency or developer, requested with a code, scoped, and expiring after inactivity, as on Shopify (Store Security & PCI).
Compelling Evidence 3.0: Visa's 2023 rule letting a merchant defeat a fraud dispute with two earlier undisputed transactions on the same card that match on device or IP and one more data element (Commerce Fraud & Abuse).
Conversion rate: human sessions with at least one order over human sessions; Shopify's is "the percentage of sessions that resulted in a purchase" (Commerce Metrics).
Cost layer: units received at one landed cost, drawn by shipments and write-offs in FIFO or average order to compute cost of goods sold (Commerce Accounting).
Credential stuffing: logging in with username and password pairs leaked elsewhere, at scale; the usual route to store account takeover (Commerce Fraud & Abuse).
Crosswalk (record mapping): the row that says this order, item or refund here is that record in another system, with both sides' versions (ERP & Integrations).
Customer deposit: money captured before goods ship, held as a liability and applied to the invoice or sale at fulfillment (Commerce Accounting).
Cutover (replatforming): the window in which the old store stops selling and the new one starts: final delta, old billing paused, traffic switched, balances reconciled (Replatforming & Migration).
Daily summary posting: sending a day's orders to the ERP as one journal entry by account and channel instead of order by order (ERP & Integrations).
Days of supply: units on hand over average daily units sold in the trailing 28 days (Commerce Metrics).
Demand surcharge (peak surcharge): a carrier's per-package charge for the holiday season, such as FedEx's residential surcharge from late October to mid-January (Peak Season & Drops).
Denial of inventory: bots holding stock in carts or reservations without buying, so nobody else can (OWASP OAT-021) (Commerce Fraud & Abuse).
Draw: a drop in which shoppers enter during a window and winners are chosen at random, with a recorded seed and rank per entry (Peak Season & Drops).
Drop (limited release): a scheduled release of scarce stock, with its own allocation, hold time, purchase limit and published rules (Peak Season & Drops).
ERP (enterprise resource planning): the system holding the general ledger, item master and costs, purchasing, receivables on terms and the close, such as NetSuite or Business Central (ERP & Integrations).
E-skimming (Magecart): script added to a store's payment page that copies card details as shoppers type them and sends them elsewhere (Store Security & PCI).
Evaluation set: fixed real cases, with human-checked labels, that a model or prompt change must pass before release (AI in Commerce).
Featured Offer share: hours a seller held the Featured Offer on a listing over hours the listing was active; Amazon's own percentage weights by page views (Commerce Metrics).
Field ownership: which system may write which group of an object's fields, such as cost from the ERP and description from the PIM (ERP & Integrations).
Fill rate (order): units shipped over units ordered on orders due in a period, cancellations for stock counting as unfilled (Commerce Metrics).
Friendly fraud (first-party misuse): a real cardholder disputing a purchase they made or authorized (Commerce Fraud & Abuse).
Function (sandboxed): merchant or app code that runs inside the platform's checkout with fixed instruction and memory limits and no network access, such as a Shopify Function (Commerce Architecture).
GMROI: gross margin dollars over twelve months divided by average inventory at cost (Commerce Metrics).
Inventory turns: cost of goods sold over twelve months divided by average month-end inventory at cost (Commerce Metrics).
iPaaS: a hosted integration platform for flows between systems, with connectors, mapping and error queues, such as Celigo, Boomi or MuleSoft (ERP & Integrations).
Isolated security patch: a fix for one vulnerability applied without a full upgrade, which Adobe ships monthly for Adobe Commerce (Store Security & PCI).
Metric value (frozen): a computed metric for a period under one definition version, frozen when reported and restated only by a superseding row (Commerce Metrics).
MRR (product subscriptions): the next renewal's merchandise value of every active subscription normalized to a month; a run-rate, not revenue (Commerce Metrics).
On-time ship rate: orders shipped by the ship-by date of their stored promise over orders shipped (Commerce Metrics).
Order pipeline: the order's one synchronous write (order and event together) followed by every other context reacting to its events (Commerce Architecture).
Payment page script inventory: the list of every script on a payment page with its justification and integrity method, required by PCI DSS 6.4.3 (Store Security & PCI).
Pod (tenant shard): a set of merchants on their own isolated datastores, routed to at the edge, as Shopify scales its shops (Commerce Architecture).
Pre-queue: a waiting room that opens before a sale and admits everyone present in random order at the start (Peak Season & Drops).
Principal versus agent: whether a seller controls goods before they transfer and books gross revenue, or arranges the sale and books its fee (Commerce Accounting).
Repeat purchase rate: the share of a first-order cohort that orders again within a stated number of days (Commerce Metrics).
Retail inventory method: valuing inventory from retail prices and a cost-to-retail ratio, often combined with LIFO by large US retailers (Commerce Accounting).
Return rate (by order month): units on received returns over units shipped, assigned to the month of the order and provisional until the return window closes (Commerce Metrics).
Returns reserve: the refund liability and return asset booked for sales still expected to come back, estimated from return history (Commerce Accounting).
SAQ A script criterion: the 2025 eligibility condition that a merchant embedding a provider's payment form confirm its site resists script attacks, by its own controls or the provider's written confirmation (Store Security & PCI).
Scalping: buying limited goods by unfair automated means to resell them (OWASP OAT-005) (Commerce Fraud & Abuse).
Shipping and handling election: the US GAAP choice to treat shipping after control passes as a fulfillment cost rather than a separate service (Commerce Accounting).
Sign-in password migration: importing customers with their old hash kept aside, verifying it at first sign-in and then setting the password natively, since hashes don't move between platforms (Replatforming & Migration).
Subresource Integrity (SRI): a hash on a script tag that makes the browser refuse the file if its bytes change (Store Security & PCI).
Tamper detection (PCI DSS 11.6.1): checking a payment page's scripts and security headers as the browser receives them, at least weekly by default, and alerting on unauthorized change (Store Security & PCI).
Token migration (replatforming): moving stored payment methods processor to processor or into a new platform's gateway, returning a mapping file of old to new IDs (Replatforming & Migration).
Units per order (UPT): units on top-level order lines over orders, bundles counted once (Commerce Metrics).
Waiting room: a gate that admits shoppers at the rate checkout can serve, with a signed token checked again at checkout (Peak Season & Drops).
Webhook delivery: one event sent to one subscriber, retried until acknowledged and deduplicated by the event ID (Commerce Architecture).