Reporting API

Developers can use the Reporting API to download sales, earnings, and subscription reports.

• Create a Security Profile
• Map the Security Profile to the API
• Request LWA Access Token
  • 1. Send token request
  • 2. Save the response
  • 3. Handle any error responses
• How to use the access token
• Reporting API URL
• Request report file URLs
  • Syntax
  • Example
  • Errors
• Use the S3 URL to download the report
  • Error messages:
• Reporting API FAQ
• Sales report fields
  • Earnings and payments reports fields
  • Subscription report fields
  • Subscriptions overview downloadable report fields
  • Marketplace information
• API Data Security

To use Developer Console APIs, you need to create a security profile and map the security profile to the API. Security profile is the mechanism used to generate access tokens for API access.

Create a Security Profile

To create a security profile, follow these steps:

1. Login to your Amazon Developer Console account. You will be prompted to create an account if you do not already have one.
2. In the main navigation, click Apps & Services.
3. Click API Access in the sub-menu.

4. Click the name of the API.

   

5. Click the Create a new security profile button.
6. Enter a Security Profile Name and Security Profile Description for your new profile, then click Save.
7. Save your Client ID and Client Secret (from the Web Settings tab), as you will need this information to access the Sales Reporting API.

   

Map the Security Profile to the API

To map the security profile to the API, follow these steps:

1. Return to the API Access page.
2. Click the API name to select the API.
3. Select your new security profile from the drop-down list.
4. Select Attach to associate the security profile with this API. The API name and attached security profile is added to the Security Profile(s) in use panel.

   

You can now use the client ID and client secret to request a Login With Amazon (LWA) access token.

Request LWA Access Token

With your client ID and client secret, use the Login With Amazon API to request a Login with Amazon access token by following these steps:

1. Send token request

Send a POST request to https://api.amazon.com/auth/o2/token with the following header and content:

• Header: Content-Type: application/x-www-form-urlencoded
• Content:
  • client_id: The client ID you saved in step 7 of Create a Security Profile.
  • client_secret: The client secret you saved in step 7 of Create a Security Profile.
  • grant_type: Set to client_credentials.
  • scope: Set the value to appstore::apps:readwrite (or adx_reporting::appstore:marketer for the Reporting API).

Sample JSON content:

{
    "grant_type": "client_credentials",
    "client_id": "amzn1.application-oa2-client.<your-client-id>",
    "client_secret": "<your-client-secret>",    
    "scope": "appstore::apps:readwrite"
}

Sample cURL request:

curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=client_credentials&client_id=amzn1.application-oa2-client.<your-client-id>&client_secret=<your-client-secret>&scope=appstore::apps:readwrite' https://api.amazon.com/auth/O2/token

2. Save the response

The response looks like this:

{
    "access_token": "Atc|MAEBI...",
    "scope": "appstore::apps:readwrite",
    "token_type": "bearer",
    "expires_in": 3600
}

• access_token: The access token.
• expires_in: The number of seconds until the access token expires.
• scope: Will be appstore::apps:readwrite (or adx_reporting::appstore:marketer for the Reporting API).
• token_type: Will always be bearer.

3. Handle any error responses

If your token request results in an error, the response message body includes one of the following error messages:

How to use the access token

Once you have obtained a valid access token, send a request to the Reporting APIs with the Authorization header set. The value of the Authorization header is Bearer <YOUR_ACCESS_TOKEN>, where <YOUR_ACCESS_TOKEN> is the value of the access_token field in the response from Request LWA Access Token. The access token is a long string of characters beginning with "Atc|".

Sample cURL request:

curl -v -X GET "<see below for URL format>"   -H  "Authorization: Bearer Atc|MAEBIKfsULrH7jSzvJTV8UmiHWr9M86O3JRmv4t1hqoCBriSMEP5Gsey_FiBxteZ8oxGd6abGuOFga8fwnMhmSD_Sg4MI4odXLPgB2IVs8M1uswjuWjnsMcvehpWvf9tzQT8HTWiBigInJLB8BrMg5J3O02hlTvcF441XxXDXthyj993COJ2u5swOTKjC_dcijiN8amuzrj32rh9Fr3CNgCpoZ0WqXnBhoHUVMYSOBV-owA5rI4-OfysXC71Zbtv1hb8igk"  

When the access token expires, get a new one by following the procedure above in Request LWA Access Token and start using the new access token in your requests. You will know your access token has expired if it has been over an hour since you last requested an access token and you start getting 403 Forbidden HTTP errors with a message that says "Request is not authorized."

Reporting API URL

Use the following as the base URL for sending Reporting API requests:

developer.amazon.com

Request report file URLs

You can use the Reporting API to download the following files:

• Single sales or subscription report file
• Earnings and payments report file
• Subscription overview report file

The API request returns a URL which you can use to download the file from the secure S3 storage location.

Syntax

/api/appstore/download/report/sales/<year>/<month>

/api/appstore/download/report/earnings/<year>

/api/appstore/download/report/earnings/<year>/<month>

/api/appstore/download/report/subscription/<year>/<month>

/api/appstore/download/report/subscriptions_overview/<year>/<month>

Parameters

Example

The following example shows how to request the sales report for April 2024.

Request:

curl -v -X GET "https://developer.amazon.com/api/appstore/download/report/sales/2024/04" -H "Authorization: Bearer Atc|MQEBIDdrcC586BxhFBdS7FQVS454oUO-fo90H5gUYVMZB1UVsPFoOPLj_zrpkf9BuMrx-PksU_qDJHL-PJ5suEQTigL1tv7A6AKlyoJJaoyzyzKhd0dwWw3LWUGrlxXxW459nJJH66F89GSBolrmlfuNONly8Cbts2Fy_KHI9YwvzwSVcgf_nvefss_H1O8tsvoYpORVuL8IXBrzT7bHxU0Xj5VjiaxDtU6N4oOQafefT8AcdN0IOYnh3Us8uEeeur3_OH473JwO3SjA4NRaS61Aq37UyhvM9pK3ccGOO5JoMkw1V9kDQQVhKiGWfCoTUBlaVkU"

Response:

https://appstore-adx-sales-reports-prod.s3.amazonaws.com/monthly/85923/40-4202/sales-2024-04.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20180405T060912Z&X-Amz-SignedHeaders=host&X-Amz-Expires=299&X-Amz-Credential=AKIAJMFYXPVLQKTRRB7Q%2F20180405%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=adab43be54631565d330727383341d56989d129e4dea151411cf7a802b9e5e12

Errors

If your token request results in an error, the response message body includes one of the following error messages:

Use the S3 URL to download the report

The reporting API returns an S3 URL, which you can use to download the report.

Error messages:

You may receive one of the following error messages from the API:

Report Not Available: You try to copy a file, but a file with the specified name does not exist in the S3 folder: fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

User not authorized: If you try to use the Reporting API without a valid access token.

Server Unavailable: If the API server is unavailable when you send a request, or if the S3 bucket is not available when you try to download the report, you will receive an HTTP 404 error code.

For additional information, see S3 error responses.

Reporting API FAQ

Q: What is the earliest report that I can retrieve using the API?

The earliest available report is January 2018. Reports for 2017 and earlier years are not available.

Q: How do I delete the security profiles?

Security profiles can be deleted only by admin level users. Navigate to the Security Profiles tab under Apps&Services, choose and delete the required security profiles.

Q: Why do cURL commands have scopes defined as Marketer?

Scope is a required field for API access. Marketer is defined as a default scope for the sales reporting API.

Q: Can the access token and pre-signed S3 URL be used forever?

No, The access token is valid only for one hour. The pre-signed S3 URL is valid only for 5 minutes. These timeouts are for security reasons.

Q: Can the security profile Client ID and Client Secret be used forever?

Yes. They can be used until the day security profile is deleted from Developer Console. However, for your security, we strongly recommend you update your API associated security profiles at least once every 6 months.

Q: I have 5 admins in the team. Can all of them create security profiles? If yes, how is it managed?

Yes, all the 5 admins can create security profiles. Every admin can see all the security profiles (Even the profiles created by other admins)

Sales report fields

The CSV file is a text file with a .csv file extension. The CSV file must use UTF-8 encoding to support localized strings.

The CSV file contains one header row, which displays the column titles. Each subsequent row in the file contains the information for one report item. The Invoice ID field defines a unique identifier for each line-item in the report.

The following table describes the fields for each entry (row) in the CSV file.

Notes

• The sales data is updated every 24 hours. If you are automating your data pull, the recommendation is to run your scripts every 24 hours to get the latest information. Note that the reported information can have up to 48 hours of lag.
• The API supports up to 3 requests per second. API calls made more frequently may lead to degraded performance.
• The earnings are estimated in this file. It may not match exactly with your end of month earnings report which may include additional adjustments not captured here.
• All adjustments are shown in the month in which the adjustment is made and not in the month the original transaction occurred.
• Test ASINs show null values for “Title” and “Item Name”. This known issue will be fixed in a future release.

Earnings and payments reports fields

The CSV file is a text file with a .csv file extension. The CSV file must use UTF-8 encoding to support localized strings.

The CSV file contains one header row, which displays the column titles. Each subsequent row in the file contains the information for one report item.

The following table describes the fields for each entry (row) in the CSV file.

Subscription report fields

The CSV file is a text file with a .csv file extension. The CSV file must use UTF-8 encoding to support localized strings.

The CSV file contains one header row, which displays the column titles. Each subsequent row in the file contains the information for one report item.

The following table describes the fields for each entry (row) in the CSV file. The Amazon marketplace, vendor SKU, subscription title, and subscription duration are values that you entered when you configured this subscription in the Developer Console.

Subscriptions overview downloadable report fields

The CSV file is a text file with a .csv file extension. The CSV file must use UTF-8 encoding to support localized strings.

The CSV file contains one header row, which displays the column titles. Each subsequent row in the file contains the information for one report item.

The following table describes the fields for each entry (row) in the CSV file.

Marketplace information

The following table displays the country/region abbreviations and currency types for each Marketplace.

API Data Security

All data that you can access through the Reporting API is Amazon confidential and is intended for the use of the developer only.

If you give API access to trusted third-parties (to support your day-to-day operations), you are agreeing to share that information at your own risk. Amazon assumes no responsibility for any loss or damage caused by sharing this information.

If you decide to share your API access with a third party, please follow these guidelines:

1. Create a dedicated security profile for the third party.
2. Include the third party business name in the security profile name (such as ReportingAPI_<your company name>_<third party name>).
3. In the security profile description field, clearly describe who will be using the security profile.

For your own protection, we strongly recommend that you update your security profiles every six months (all security profiles associated with the sales reporting API).

Last updated: Aug 22, 2025