amzn / selling-partner-api-models

This repository contains OpenAPI models for developers to use when developing software to call Selling Partner APIs.
Apache License 2.0
580 stars 730 forks source link

New delegation use case added to Tokens API - Who and how #1981

Closed martin-hepworth closed 2 years ago

martin-hepworth commented 2 years ago

I have noticed that Amazon are now allowing delegated access to PII via a delegated app that has access to PII.

How can I find a list of these apps and how I would use them?

I desperately need the PII as the customers I am working for do direct to consumer deliveries and I can not get access signed off via the SP-API so this might give me a route to go down but there is no list or easy way to search for companies that would provide this information.

tspicer commented 2 years ago

For reference, https://github.com/amzn/selling-partner-api-docs/discussions/1393

Like most things RDT and PII, it is not entirely clear how this process is suppose to work. For example, if delegation occurs do both apps need to be approved for PII, meaning you can only delegate to an app that has gone through the process and is approved for PII? I understand the intent, but the entire PII/RDT process is really broken.

martin-hepworth commented 2 years ago

Thanks, I'd seen the annoucement but it didn't provide me with any additional useful information.

I would expect both apps not to need PII approval or it would be pointless. If I got PII approval I wouldn't delegate the RDT request.

It seems Amazon have switched off PII from MWS without allowing people to access it via the SP-API route so they effectively stopping business like mine from being able to help people integrate their Amazon Seller Central system with their ERP and Courier systems.

parvathm commented 2 years ago

Hi @martin-hepworth

To find apps to use delegation api please refer to App store that works for your use case. Both apps doesn't need PII access. Delegatee who has PII access can access the data.

Thanks, Parvathm SP API Developer Support.

tspicer commented 2 years ago

@parvathm Can you explain the use case further? For example, I'm developer A. I have an existing app. My public app is NOT approved for PII. My customer, developer B, created their own app. My understanding is they must undertake the review process for their app and be approved for PII. Correct? If developer B is approved, they can delegate PII access they were granted to developer A?

martin-hepworth commented 2 years ago

@parvathm

Is there an easy way to search for these. I just need an app that has access to PII that will not cost me a fortune to use.

Thanks

parvathm commented 2 years ago

@tspicer ,

Yes, once Developer B has PII access. Developer A can delegate to Developer B . If you have any further questions. please open a support case.

Thanks, SP API Developer Support.

tspicer commented 2 years ago

@parvathm , don't you mean that Developer B, who has been approved, can delegate PII access to Developer A app?

I was told that Public apps are not allowed PII access. This is directly from the Amazon team " accessing Personally Identifiable Information (PII) as a Public developer is not supported by our policies."

If this is true, the only way a public app can get PII is by a customer delegating access to us.

I hope you can appreciate how frustrating this process is because our application is now almost 6 months long. We have been a public app for almost 4 years. Why even allow a public app in the marketplace to undergo a review if the policy is what was communicated to us????

Delegation would only make sense if it is a form of access control for public apps like ours. A customer can go through an approval process on their own, and if they are approved, this allows them to "delegate" access to our app. This limits the scope of PII access so we can process DTC and tax info for them.

martin-hepworth commented 2 years ago

@parvathm I have opened multiple support cases around these issues and they keep getting closed with generic response like use SP-API. Here's a link to the form you completed.

Amazon are not offering up the details needed for the developers to do this work for their Seller Central Partners. It is almost like Amazon is trying to make Seller Central Integration impossible. A cynic would suggest this is an attempt to force those sellers onto vendor central where Amazon makes a better margin.

tspicer commented 2 years ago

@martin-hepworth I agree, the details on delegation and PII, in general, are severely lacking. I have a number of customers that will no longer be able to undertake FBM//MFN. While I understand the desire to protect PII/sensitive data, the process is broken. As it stands, I have customers that will need and plan to switch platforms (Shopify...) for any direct sales.

Feel free to message me directly if you want to discuss this further.

github-actions[bot] commented 2 years ago

This is a very old issue that is probably not getting as much attention as it deserves. We encourage you to check if this is still an issue after the latest release and if you find that this is still a problem, please feel free to open a new issue and make a reference to this one.