Unauthorized: Access to requested resource is denied

[trbrink21]

I've tried connecting to a few different endpoints but receive the same error every time:
SellingApiForbiddenException: [{'message': 'Access to requested resource is denied.', 'code': 'Unauthorized', 'details': ''}]

Here is what my code looks like:

from sp_api.api import Reports, Orders
from datetime import datetime, timedelta

credentials=dict(
        refresh_token='Atzr|*****', (Self authorized in Developer Central page)
        lwa_app_id='amzn1.application-oa2-client.******',
        lwa_client_secret='0176****',
        aws_secret_key='TnmG*****', (IAM User security key)
        aws_access_key='AKI****', (IAM User access key)
        role_arn='arn:aws:iam::308346568703:role/***', (IAM role arn)
    )

res = Orders(credentials=credentials).get_orders(CreatedAfter=(datetime.utcnow() - timedelta(days=7)).isoformat())
print(res.payload)  # json data

createReportResponse = Reports(credentials = credentials).create_report(reportType='GET_FLAT_FILE_OPEN_LISTINGS_DATA')

Any help would be appreciated, I haven't found much luck on the internet... thanks in advance!

[Albertocanal]

Hello @trbrink21,
I think you have to add to your code the marketplace where your are signed up and in your call to get_orders endpoint you have to add the marketplaces where you want to search in too.
For example, this is my code and it works for me.

marketplaces = ['A1PA6795UKMFR9','A1RKKUPIHCS9HS','A13V1IB3VIYZZH','A1F83G8C2ARO7P']
orders_obj = Orders(marketplace=Marketplaces.ES, credentials=credentials) # In my case i'm signed up in Spanish Marketplace
res = orders_obj.get_orders(
LastUpdatedAfter=(datetime.utcnow() - timedelta(days=7)).isoformat(),
MarketplaceIds=','.join(marketplaces))

I hope it will resolve your problems.

[trbrink21]

Hello @Albertocanal thanks for the suggestion.

When I update my code similar to what you showed me and I am still getting the access to requested resource is denied error.

[Albertocanal]

mmm have you checked that your credentials are correct? I can not think of anything else...

[trbrink21]

Triple checked all the credentials... I saw in another post that if changes are made to the app then a new refresh token is needed so I'll give that a try

[extrasys]

Hello @trbrink21
For the variable lwa_app_id you must use the lwa_client_id as value.

[trbrink21]

The LWA Client ID is what I am using for the lwa_app_id value.

[Priyankk18k]

check your marketplaces as well. The code which worked for me is below.
refresh_token='xxxx'
lwa_app_id= 'this will be your LWA client ID'
lwa_client_secret= 'LWA secret'
aws_secret_key= 'xxxxxxxxx' -> It should be of your IAM User Cross check and validate. The Keys which come while creating the app will not work here.
aws_access_key= 'xxxxxxxx' -> same as above
role_arn= 'arn:aws:iam::XXXXXXXXX:role/your_app_name' -> It should be role ARN

client_config = dict(
role_arn=role_arn,
refresh_token=refresh_token,
aws_access_key=aws_access_key,
aws_secret_key=aws_secret_key,
lwa_app_id=lwa_app_id,
lwa_client_secret=lwa_client_secret,
)

print(json.dumps(client_config))
from sp_api.api import Orders, Finances, ProductFees
from sp_api.base import SellingApiException, Marketplaces, SellingApiForbiddenException
import datetime
from datetime import timedelta, date
import time
import csv

marketplaces = ['XXXXXXXX']

res = Orders(credentials=client_config, marketplace=Marketplaces.ES) # check your marketplace accordingly if it is India Put IN in place of ES
data = res.get_orders(CreatedAfter='2017-03-30',CreatedBefore=date.today().isoformat(),MarketplaceIds=marketplaces)
amazon_data = data.payload
If Marketplace Id is Different Then You will get the same error response as "access denied".
I hope it helps. Please check the Answer if it works for you as it might help others.

[trbrink21]

Thanks for your suggestion, someone else already mentioned specifying a marketplace which I did and did not resolve my error. My error may be due to my company using the API to pull reports from Vendor Central instead of Seller Central. Vendor Central has different resource URLs so it seems like this python wrapper will not work in my situation

[Priyankk18k]

Yes True, This wrapper is only for Sellers Central.

[mrmosconi]

I was able to solve this by re-creating my IAM user and role. The directions must be followed TO THE LETTER. I had forgotten one of the steps where you associate x with y (sorry, I know that's not helpful).

The problem, which is on Amazon's side, is that they return a 403 in a very large number of scenarios, so it's impossible to determine exactly what's wrong.

[paulabirocchi]

Hi @mrmosconi , what do you mean "The directions must be followed TO THE LETTER.'?

[alperenYagci]

adding "Resource": "*" to user policy in AWS solved my auth issue.

Ex: {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "",
"Resource": ""
}
]
}

[paulabirocchi]

It didn't solved my auth issue :(

[alperenYagci]

have you authorized your developer profile for appropriate access on amazon seller central? Ex: inventory access.

[paulabirocchi]

I will check it, thanks. My "Action" is different too. Should I use "Action":"*" ?

[waleedahmed90]

I had a similar issue, and nothing seemed to work.
Here is what worked for me:
When i was registering the APP, i had used USER ARN in IAM ARN option. I replaced it with ROLE ARN and it works. Now the same error is not there anymore.

[mudassirzr]

@waleedahmed90 Thanks for this, I had done the same mistake. I had been literally frustated by this, since I was getting the same error and changing the IAM ARN to Role ARN just solved it!

[kota-imai]

This thread is helpful for me! Thank you

[indiaujla]

I went around the houses wit this one, what helped me was to add the role arn to my credentials (the yml file wasn't working for me).

I'd also recommend going through the AWS IAM process a couple of times, to get familiar with it, in case you are missing a step. On my third go, I noticed I was doing something wrong!

My example is for the UK

`
from sp_api.base import Marketplaces
from sp_api.api import Orders

credentials = dict(
refresh_token='add your refresh token',
lwa_app_id='add your LWA app ID',
lwa_client_secret='add your LWA App Secret Access Code',
aws_access_key='add your AWS access code',
aws_secret_key='add your AWS secret key',
role_arn='add your role ARN'
)

order_client = Orders(credentials=credentials, marketplace=Marketplaces.GB)
order = order_client.get_order('206-4614418-1551519')
print(order) # order is an ApiResponse
print(order.payload) # payload contains the original response
`

[jorgeastiazaran]

I did the following to solve the issue:

• Use the correct marketplace parameter (complete instructions: https://stackoverflow.com/a/68848584/11296112).
• Use the ROLE ARN when registering the app (Unauthorized: Access to requested resource is denied #128 (comment)).

Thanks for your help!