[source-amazon-sellerpartner] Access to requested resource is denied

[andreyAtBB]

Connector Name

amazon-seller-partner

Connector Version

4.2.3

What step the error happened?

During the sync

Relevant information

When doing historical data sync which includes Orders, OrderItems, ListFinanicalEvents stream we are receiving error "Access to requested resource is denied." on Orders.

Airbyte support team looked into this and confirmed missing roles in their Amazon App.
Quote:

It looks like is is possible to add the roles to our app, but it requires Amazon's approval and it looks like this is a fairly rigorous process from comments in this issue. So unfortunately, at the moment our Amazon Seller Partner source connector does not support syncing regulated orders.

Judging by what’s written in this issue and this issue it looks like we have a very little chance to get our own app approved as well, so it would be great if Airbyte, as an Amazon client/partner, can reach out to them and clarify this process, requirements and timing.

Relevant log output

2024-05-15 00:10:46 replication-orchestrator > failures: [ {
  "failureOrigin" : "source",
  "failureType" : "system_error",
  "internalMessage" : "403 Client Error:  for url: https://sellingpartnerapi-na.amazon.com/orders/v0/orders?NextToken=TOKEN&MarketplaceIds=XYZ",
  "externalMessage" : "Access to requested resource is denied.",
  "metadata" : {
    "attemptNumber" : 9,
    "jobId" : 11823074,
    "from_trace_message" : true,
    "connector_command" : "read"
  },
  "timestamp" : 1715728285452,
  "streamDescriptor" : {
    "name" : "Orders"
  }
}

Contribute

• Yes, I want to contribute

[marcosmarxm]

Hello @andreyAtBB, thank you for reporting the issue. I have forwarded it to the connector team for investigation and resolution.

[andreyAtBB]

Hey guys! In order to fix this issue I suggest you to add the following logic:

When you're pulling data and receive this error:
{ "errors": [ { "code": "Unauthorized", "message": "Access to requested resource is denied.", "details": "Access token is missing in the request header." } ] }

You can attempt to get and RDT (RestrictedDataToken) by calling this API:
https://sellingpartnerapi-na.amazon.com/tokens/2021-03-01/restrictedDataToken
with body like:
{ "restrictedResources": [ { "method": "GET", "path": "/orders/v0/orders" } ] }
and x-amz-access-token header with amazon token you currently have.

In response you'll receive (if app is whitelisted for restricted data of course) "restrictedDataToken" and use it to call API endpoint that failed previously. The token is valid for 1hr so you'll need to implement refresh capability for long runs.

See https://developer-docs.amazon.com/sp-api/docs/tokens-api-use-case-guide#terminology for more info.

Please let me know if I can help with anything.