What gets stripped, and why

Card and figure art is the first redaction surface, and the most asymmetric across games. The bucket split mirrors how the source licensing actually works:

• MTG art— full Scryfall-licensed CDN URL returned. Scryfall’s redistribution terms are partner-friendly for catalog reproduction at thumbnail and detail sizes.
• Lorcana / One Piece art — returned at our own cached URL with a Wizards / Bandai attribution string in the response. Partners are expected to honor the attribution on display.
• Pokemon TCG art — imageUrl is nullon every B2B response. Pokemon imagery falls under TPCi fan-content terms; redistribution to a third-party commercial surface isn’t in scope. We return everything else (name, set, rarity, printing metadata, prices) — just not the art file.
• Figure photography — returned. MFC / Pop Mart imagery is either CC-attributed editorial or first-party manufacturer art, both partner-OK.
• User-uploaded photos— never returned on B2B routes. User-derived imagery isn’t part of the partner catalog contract.

The headline USD value + multi-currency strip stay. The per-vendor tick data does not:

• Headline price — priceUsd field returned (median across observed marketplaces, USD, integer cents). Always present.
• 30/90-day history — history[] returned, downsampled to one point per day. Source- anonymized — the tick is a median, not a per-vendor quote.
• altCurrencies strip — EUR via Cardmarket (where applicable), JPY via Yahoo Auctions / Mercari (where applicable). Returned.
• TCGplayer per-printing ticks— removed. Partners running TCGplayer integrations have their own affiliate / data contracts. We don’t re-pipe theirs.
• Cardmarket per-printing ticks — removed for the same reason. The EUR strip in altCurrencies is a derived median, not raw Cardmarket ticks.
• Affiliate CTAs / partner-link wrappers — never on the B2B surface. The consumer web wraps headline prices with affiliate-tagged outbound links; the partner surface returns bare values, no UTMs, no wrappers, no CTA text.

Aggregate counts of how many users own / list-for-trade / wishlist a given card or figure exist on the consumer surface, and follow two stacked rules:

• k=5 anonymity floor on public consumer routes. If fewer than 5 users have a given printing in their collection, the count is suppressed (returned as zeros with suppressed: true). This protects users with rare-printing collections from being identifiable by inventory size.
• Unconditional zero on B2B. Even past the k=5 floor, B2B responses get the suppressed-zero shape. Community signal isn’t part of the catalog license — it’s a derived property of our user base, not the card itself.

// B2B socialCounts shape — always this on partner responses:
{
  "owners": 0,
  "forTrade": 0,
  "wishlisted": 0,
  "suppressed": true
}

The suppressed: trueflag is the contract: the shape is stable so your client can render the field as “data unavailable” without branching on whether the key exists.

/v1/series/:id/pull-stats returns Bayesian- smoothed pull rates per slot, but never the underlying per-user pull records. The smoothed rate is a moment-statistic on the observed distribution; the raw observations are not partner-readable. Even with a bearer key, no endpoint returns a list of users who reported a pull.

• No endpoint returns a list of user IDs, handles, or emails.
• /v1/discover/users only returns the opted-in showcase population — users who’ve published a public profile. Anonymous user records (the majority of the base) are unreachable from B2B.
• Even on opted-in showcase users, only the showcase fields (handle, display name, public binders) are returned. Email, push tokens, geo, device IDs — never.
• Trade-graph data (who’s traded with whom) is not partner-readable. Trade volume aggregates by card or set may surface in discover feeds — actor-anonymized.

If you’re building a price terminal or a catalog mirror, the redaction surface is invisible — you get every field your product needs. If you’re building something that wants community signal (deck-tracker apps that surface “collected by N players”, marketplace floor discovery), you’ll see the suppressed-zero shape and should plan around it. Email b2b@rarix.app with the use case — community-signal contracts are a v2 conversation, not a v1 surface.

Every B2B response carries an implicit redaction stamp in the response envelope (meta.redactionsApplied) listing which families of fields were stripped. This is here so your consumers can prove to their auditors that the data they received was source-clean — and so we can answer “why is this field null” without a support ticket.

{
  "meta": {
    "redactionsApplied": [
      "pokemon_imagery",
      "tcgplayer_ticks",
      "cardmarket_ticks",
      "social_counts",
      "affiliate_ctas"
    ],
    "redactionPolicyVersion": "2026-05-19"
  },
  // ... rest of the response
}