Selling Partner API
What Amazon's Selling Partner API is, who builds on it, how a seller authorizes an application, and its regions and limits.
As Amazon publishes it
The subject matter as Amazon publishes it. Nothing on this page describes a particular application; every statement restates the public documentation listed under Sources.
What it is
The Selling Partner API (SP-API) is Amazon's REST API for selling partners — sellers and vendors — and for the developers who build on their behalf.
- It exposes a selling partner's own data: orders, inventory, catalog items, pricing, financial events, reports and notifications.
- It is a different API from the Amazon Ads API, with its own registration, roles and authorization.
Developers and roles
- Developer types. A private developer builds an application only for its own organization. A public developer builds an application other selling partners authorize; it registers through the Solution Provider Portal and must list the application in the Selling Partner Appstore.
- Roles. Every application requests roles, and each role unlocks a set of operations — for example Inventory and Order Tracking, Finance and Accounting, Brand Analytics, Pricing, Product Listing and Selling Partner Insights. An application can call only the operations of the roles it was granted.
- Restricted roles. Roles that expose personally identifiable information (PII), such as direct-to-consumer shipping or tax invoicing, are restricted: they need additional vetting, and each call that returns PII needs a short-lived Restricted Data Token (RDT) issued by the Tokens API.
- Policies. Every developer accepts the Acceptable Use Policy (AUP) and the Data Protection Policy (DPP). They limit what Amazon data may be used for and how it is stored, protected, retained and deleted.
Authorization
- A selling partner authorizes an application through Login with Amazon (LWA) — from the Selling Partner Appstore or from the application's own website — and the application receives a refresh token for that selling partner.
- The refresh token is exchanged for an access token that expires after one hour and travels on every call in the
x-amz-access-tokenheader.
No request signing
Since October 2023 calls no longer need AWS Signature Version 4 signing or an AWS IAM role; the LWA access token is enough.
Regions and limits
| Region | Host |
|---|---|
| North America | sellingpartnerapi-na.amazon.com |
| Europe | sellingpartnerapi-eu.amazon.com |
| Far East | sellingpartnerapi-fe.amazon.com |
- Usage plans. Each operation has a rate and a burst, enforced as a token bucket per selling partner and application.
- Exceeded limit. An exceeded limit answers HTTP 429.
- Sandbox. Each regional host has a sandbox counterpart that returns static or dynamic test responses, for developing without touching live data.
- Asynchronous data. Large datasets come from the Reports API (request, poll, download), and changes can be pushed through the Notifications API to an Amazon SQS queue or Amazon EventBridge.
In this section
- Selling partner — who authorizes an application, what the authorization returns, marketplaces per region
- Developer types and roles — private and public applications, every role, restricted roles and the Restricted Data Token
- Data protection and retention — the Acceptable Use Policy and the Data Protection Policy, section by section
- Identity verification (KYC) — who verifies, which documents, how long it takes
- Sandbox — static and dynamic sandboxes, endpoints, limits