Amazon SP-API DPP Checklist + Pentest Evidence Templates
Access to Amazon’s Selling Partner API comes with a condition: pass the Amazon data security assessment, and make sure the pentest report at the center of it says what you think it says. Most of the trouble we see isn’t weak security, but rather a mismatch between what was tested and what the report claims was tested. One team’s report listed its scope as Web App. The assessor flagged it, and the team spent time proving in writing that the APIs had been covered too.