Amazon Selling Partner API · without your own application
ShipStream Data Border holds the application registration and the encrypted seller tokens. Your warehouse system posts {{ship_to_name}}, we resolve the buyer address in memory, buy the label, hand you back [REDACTED] plus a tracking code, and print the real thing straight to warehouse-zebra-01.
request body
to_address:
name: "{{ship_to_name}}"
street1: "{{ship_to_address1}}"
city: "{{ship_to_city}}"
phone: "{{ship_to_phone}}"
parcel: { 10 × 8 × 4, 16 oz }
Systems in audit scope
0 — nothing here holds buyer PII
POST /api/label-proxy/forward
origin allow-list
GET /orders/v0/orders/113-9483920-1029338/address
buyer address resolved
POST api.easypost.com/v2/shipments
response scrubbed
POST /api/print/send → device-hub
Amazon Selling Partner API
sellingpartnerapi-na.amazon.com
EasyPost
api.easypost.com/v2/shipments
Device Hub
warehouse-zebra-01 · 4×6 thermal
▍ idle — press Ship one order
Runbook
Every answer here is the actual request, the actual response body and the page in the docs that owns it.
Pick one
Answer ▍
Request
GET /api/pii/getPII/113-9483920-1029338 -H "x-seller-access-token: ..." -H "x-amazon-token-secret: ..."
Response
429 Too Many Requests
{ "error": { "message": "PII access throttled" } }One read per order per hour, by design — retrying will not help. Post the shipment to /api/label-proxy/forward instead: it resolves the address inside the border, so your side never needs the read.
PII access limits →The hard part
Three mechanisms do the holding: the credentials never decrypt without your secret, the gates close by default, and every touch leaves a line you can hand to an auditor.
01 · Custody
Amazon refresh tokens are sealed with AES-256-GCM and a scrypt-derived key. The key material arrives on the request as x-amazon-token-secret and is never written down.
02 · Need to know
The limits are structural, not advisory. A compromised integration credential buys an attacker one address per order per hour — and nothing at all on shipped orders.
03 · Evidence
Ten log types, one shape, ready for your SIEM. Every record carries the order, the seller, the tenant, the IP, the user agent and the result.
{
"type": "pii_access",
"action": "getPII",
"orderId": "113-9483920-1029338",
"sellerId": "seller_9f2c1a",
"ip": "203.0.113.42",
"accessCount": 1,
"success": true
}Retention
Same order stream, same labels, two stacks. Turn your volume up and watch which column moves.
Your own integration
a typical stack
the row your app writes
streaming, seconds behind
whatever the request logged
one slab per night, kept for months
copied to a laptop-reachable box weekly
0 orders × 0.0 copies · nothing here expires on its own
Through the border
the same stack
order id, tracking, document uuid — no PII field
nothing to replicate
nothing to replicate
nothing to replicate
nothing to replicate
one read per order per hour, released after the label · 0 labels printed
running · day 1 of 30 · drag orders per day and watch the right column not move
After day 1 of 30 at 850 orders a day: 0 copies of 0 buyer addresses in a stack without a border, and 0 in a stack with one. Both printed 0 labels.
Day two
Walk the states. The left column is what your database holds at that moment — it never changes shape.
The call
POST /api/claim-code
Audit event
{"type":"authentication","event":"seller_authorized","sellerId":"seller_9f2c1a"}
In your database
a seller id and an access token
PII fields: 0
Inside the border
the encrypted refresh token, sealed with the tenant secret
Our problem, contractually
Also true
Labels are the hard case, not the only case. Point any allow-listed Selling Partner API path at /passthrough-api/* and the border signs it, routes it and scrubs it on the way back. Orders, inventory, fees and shipping — with no application of your own to register, renew or defend.
Passthrough reference →GET /passthrough-api/orders/v0/orders?MarketplaceIds=ATVPDKIKX0DER
{
"payload": { "Orders": [ {
"AmazonOrderId": "113-9483920-1029338",
"OrderStatus": "Unshipped",
"OrderTotal": { "CurrencyCode": "USD", "Amount": "29.99" },
"ShippingAddress": { "City": "[REDACTED]", "PostalCode": "[REDACTED]" }
} ] }
}The receipt
Same line items every compliance program has. Check them against your own quotes — that is the point of publishing them.
Single app
$199/mo
2,500 labels included, then $0.02 each. One warehouse or one seller account, Device Hub printing, questionnaire support.
SaaS provider
$699/mo
$0.015 per label at any volume. Multi-tenant dashboard, white-labeled client questionnaires, full API.
You still run your own warehouse system, your own carrier accounts and your own printers. We are not trying to own those.
Full pricing and volume examples →Create an account, connect a sandbox seller, and post your first /api/label-proxy/forward today. Nothing about your warehouse system has to change except where the address comes from.
Read the version written for your shape: 3PL · WMS / OMS vendor · Seller