How Amazon SP-API Review Requests Work (Technical Explainer)

Overview

When an Amazon seller (or an authorized tool acting on their behalf) requests a review, the request goes through Amazon's Selling Partner API (SP-API) — specifically the Solicitations API. Understanding how this works helps sellers evaluate automation tools intelligently and trust that compliant tools are doing exactly what Amazon intends.

The Key Endpoint: createProductReviewAndSellerFeedbackSolicitation

The SP-API Solicitations endpoint that review request tools use is:

```

POST /solicitations/v1/orders/{amazonOrderId}/solicitations/productReviewAndSellerFeedback

```

Parameters:

• `amazonOrderId` — the unique order identifier from Amazon
• `marketplaceIds` — the marketplace where the order was placed (e.g., ATVPDKIKX0DER for US)

What it does: Triggers Amazon to send their standard, non-customizable review request email to the buyer. The tool calling the API does not control the message content — Amazon writes and sends it.

Eligibility Checks

Before calling the endpoint, a well-built automation tool should verify the order is eligible. Amazon will return an error if:

• **Too early:** The order was delivered fewer than 5 days ago
• **Too late:** More than 30 days have passed since delivery
• **Already requested:** A review request was already sent for this order
• **Order not delivered:** The order status hasn't reached a delivered state

StarQuester performs these checks before each request and automatically skips ineligible orders — avoiding wasted API calls and ensuring Amazon's rules are respected.

The OAuth / LWA Authorization Flow

Before any API call can be made, the tool needs permission to act on the seller's behalf. This happens through Amazon's Login with Amazon (LWA) OAuth 2.0 flow:

1. The seller clicks "Connect" in the tool's UI

2. They're redirected to Amazon's authorization page

3. They log in and grant the tool specific permissions (in this case, Orders read access + Solicitations write access)

4. Amazon redirects back with an authorization code

5. The tool exchanges this code for a refresh token

6. The refresh token is used to generate short-lived access tokens for subsequent API calls

The seller's Amazon password is never shared with or seen by the third-party tool. Access can be revoked at any time from Seller Central's developer app permissions page.

What Permissions Are Required

The Solicitations API requires two permission scopes:

• **`sellingpartnerapi::orders`** — to read order data (status, delivery date, marketplace)
• **`sellingpartnerapi::solicitations`** — to send the review request

Compliant tools request only these minimum permissions. Be cautious of tools requesting access to financial data, inventory, or listing management if all they claim to do is send review requests.

How Delivery Date Is Determined

The eligible review request window (5–30 days) starts from the confirmed delivery date — not the ship date. For FBA orders, Amazon tracks delivery through their logistics network. For FBM orders, delivery is determined by the tracking information uploaded by the seller.

Automation tools poll the Orders API to get up-to-date delivery status and calculate when each order enters and exits the eligible window.

Rate Limits

The SP-API has rate limits to prevent abuse. The Solicitations endpoint allows a limited number of calls per second. Well-built automation tools implement request queuing and respect these limits, processing orders in batches over time rather than all at once. This is transparent to sellers — the tool just processes the queue in the background.

What StarQuester Does with This

StarQuester runs on a scheduled job that:

1. Syncs your recent orders via the Orders API

2. Checks delivery status and eligibility for each order

3. For eligible orders that haven't been requested yet, calls the Solicitations endpoint

4. Logs the result (success or error) per order for your dashboard

All of this runs automatically once you've connected your account and configured your timing rules. The API credentials are stored encrypted and only used to make these authorized calls on your behalf.

Start your free trial and see it in action — no credit card required.