GET|POST|DELETE /passthrough-api/*

curl -X GET "https://adb.example.com/passthrough-api/orders/v0/orders?MarketplaceIds=ATVPDKIKX0DER" \
  -H "x-seller-access-token: YOUR_SELLER_TOKEN" \
  -H "x-amazon-token-secret: YOUR_TOKEN_SECRET"

{
  "payload": {
    "Orders": [
      {
        "AmazonOrderId": "123-4567890-1234567",
        "OrderStatus": "Unshipped",
        "PurchaseDate": "2024-01-15T10:30:00Z",
        "OrderTotal": {
          "CurrencyCode": "USD",
          "Amount": "29.99"
        }
      }
    ]
  }
}

{
  "success": true,
  "data": {
    "scrubbed_response": { /* SP-API response with PII removed */ },
    "shipment_id": "ship_abc123def456",
    "amazon_order_id": "123-4567890-1234567",
    "unique_shipment_id": "WMS-SHIP-001",
    "documents": [
      { "uuid": "550e8400-e29b-41d4-a716-446655440000", "path": "label.pdf" }
    ]
  }
}

curl -X POST "https://adb.example.com/passthrough-api/shipping/v2/shipments" \
  -H "Content-Type: application/json" \
  -H "x-seller-access-token: YOUR_SELLER_TOKEN" \
  -H "x-amazon-token-secret: YOUR_TOKEN_SECRET" \
  -H "x-amazon-order-id: 123-4567890-1234567" \
  -H "x-unique-shipment-id: WMS-SHIP-001" \
  -d '{ "shipment data..." }'

async function syncOrders(sellerId, marketplaceId, lastSync) {
  const { token, secret } = await tokenManager.getSellerAccessToken(sellerId)
  
  const params = new URLSearchParams({
    MarketplaceIds: marketplaceId,
    CreatedAfter: lastSync.toISOString()
  })
  
  const response = await fetch(
    `${ADB_URL}/passthrough-api/orders/v0/orders?${params}`,
    {
      headers: {
        'x-seller-access-token': token,
        'x-amazon-token-secret': secret
      }
    }
  )
  
  const data = await response.json()
  
  for (const order of data.payload.Orders) {
    await db.orders.upsert({
      amazonOrderId: order.AmazonOrderId,
      sellerId,
      status: order.OrderStatus,
      purchaseDate: order.PurchaseDate,
      total: order.OrderTotal?.Amount
      // Note: Address is scrubbed
    })
  }
  
  return data.payload.Orders.length
}

async function createShipmentWithLabels(order, shipmentData) {
  const { token, secret } = await tokenManager.getSellerAccessToken(order.sellerId)
  
  const response = await fetch(
    `${ADB_URL}/passthrough-api/shipping/v2/shipments`,
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-seller-access-token': token,
        'x-amazon-token-secret': secret,
        'x-amazon-order-id': order.amazonOrderId,
        'x-unique-shipment-id': `${order.id}-${Date.now()}`
      },
      body: JSON.stringify(shipmentData)
    }
  )
  
  const data = await response.json()
  
  // Store shipment with document references
  await db.shipments.create({
    orderId: order.id,
    adbShipmentId: data.data.shipment_id,
    trackingNumber: data.data.scrubbed_response.trackingId,
    documents: data.data.documents
  })
  
  return data.data
}

{
  "is_adb_error": true,
  "success": false,
  "error": {
    "message": "Endpoint not whitelisted",
    "details": "/some/custom/endpoint is not in the allowed list"
  }
}

{
  "errors": [
    {
      "code": "InvalidInput",
      "message": "MarketplaceIds is required",
      "details": ""
    }
  ]
}

// Good: URL-encode marketplace IDs
const params = new URLSearchParams({
  MarketplaceIds: 'ATVPDKIKX0DER'
})

// Good: Multiple values
params.append('OrderStatuses', 'Unshipped')
params.append('OrderStatuses', 'PartiallyShipped')

async function getAllOrders(sellerId, marketplaceId) {
  const orders = []
  let nextToken = null
  
  do {
    const params = new URLSearchParams({ MarketplaceIds: marketplaceId })
    if (nextToken) params.set('NextToken', nextToken)
    
    const data = await fetchOrders(sellerId, params)
    orders.push(...data.payload.Orders)
    nextToken = data.payload.NextToken
  } while (nextToken)
  
  return orders
}

async function fetchWithRetry(url, options, retries = 3) {
  for (let i = 0; i < retries; i++) {
    const response = await fetch(url, options)
    
    if (response.status === 429) {
      const retryAfter = response.headers.get('Retry-After') || (2 ** i)
      await delay(retryAfter * 1000)
      continue
    }
    
    return response
  }
  throw new Error('Rate limit exceeded')
}