Access to requested resource is denied 403 SP-API AMAZON - C#

8
votes

Problem with to call the new SP-API AMAZON. I am using the C# library provided by Amazon.

https://github.com/amzn/selling-partner-api-models/tree/main/clients/sellingpartner-api-aa-csharp!

resource api : https://sandbox.sellingpartnerapi-na.amazon.com/orders/v0/orders

{
    "errors": [
        {
            "message": "Access to requested resource is denied.",
            "code": "Unauthorized",
            "details": ""
        }
    ]
}
5
c#amazon
Do you have credentials? See following : docs.aws.amazon.com/AWSEC2/latest/APIReference/… - jdweng
Yes, I hava a credentials, acces token. - Israel T
The use the link to the test code above to solve issue. Here is one test : github.com/amzn/selling-partner-api-models/blob/main/clients/… - jdweng
Hey @IsraelT any news on this topic? I am at the same point. I can successfully generate accessTokens, but when sending any API_Request i am getting same message as shown in your original question. - Christian Rockrohr
Did you solve this Unauthorized Access? I am also getting this message and can not get success response from Amazon. - Concware

5 Answers

5
votes

I had the same error, and after days of struggle I found my solution, hope it helps somebody else.

I followed every single step in the Selling Partner API Developer Guide, but, when creating the app in the Amazon Seller Central, I used the User ARN. This was my mistake. To solve the problem I created a new app using the Rol ARN instead of the User ARN.

Like this: enter image description here

3
votes

I wrote this blog post describing all the steps for a successful Amazon SP-API Auth & Auth process. Hope you will get some insights by reading it.

https://marco-tibaldeschi.medium.com/amazon-sp-api-auth-auth-demystified-ab3bc746729b

1
votes

You must check the following headers, this error can occur due to the incorrect value from any of them.

  1. In headers you need to send x-amz-access-token i.e valid for only one-hour post generation through token API.
  2. You also have to pass the Authorization in headers this will auto-generate in postman if you choose AWS Signature type in Authorization and set the following keys(Access Key, Secret Key, Aws Region, and Service Name).

Also to test sandbox get orders API: URL value should be this https://sandbox.sellingpartnerapi-eu.amazon.com/orders/v0/orders?CreatedAfter=TEST_CASE_200&MarketplaceIds=XXXX

Sandbox API will only work as per the provided sandbox behavior.

1
votes

It looks like the guidance on the docs around adding a role doesnt seem to work (or I have messed it up somehow). The work around is to add the policy directly the user as per phamanh195 suggestion:

IAM Management Console => users => select user => add inline policy => click on JSON tab => add the following:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "execute-api:Invoke",
"Resource": "arn:aws:execute-api:::*"
}
]
}

Appreciate it is not best practices, but i've got access now.

p.s. i have removed the policy and it has defaulted back to the authorization error above.

Refer below issue reported on github : https://github.com/amzn/selling-partner-api-docs/issues/38

1
votes

Just throwing this out there, I got that error so many times and I made 100% sure everything was correct and in the end it was simply that I was using a post instead of a get. Tired eyes but I finally caught it and it worked.