Amazon MWS ListOrders from Scratchpad to request

Question

I'm trying to get the list of orders through the MWS Scratchpad. In the scratchpad everything works fine.

The HTTP POST is

POST /Orders/2013-09-01?AWSAccessKeyId=$CHIAVE_ACCESSO
&Action=ListOrders
&SellerId=$SELLER_ID
&SignatureVersion=2
&Timestamp=2016-11-29T18%3A58%3A52Z
&Version=2013-09-01
&Signature=$SIGNATURE
&SignatureMethod=HmacSHA256
&CreatedAfter=2016-10-31T23%3A00%3A00Z
&MarketplaceId.Id.1=APJ6JRA9NG5V4 HTTP/1.1
Host: mws.amazonservices.it
x-amazon-user-agent: AmazonJavascriptScratchpad/1.0 (Language=Javascript)
Content-Type: text/xml

and the string to Sign (in the second box) is

POST
mws.amazonservices.it
/Orders/2013-09-01
AWSAccessKeyId=$CHIAVE_ACCESSO&Action=ListOrders&CreatedAfter=2016-10-31T23%3A00%3A00Z&MarketplaceId.Id.1=APJ6JRA9NG5V4&SellerId=$SELLER_ID&Signat    ureMethod=HmacSHA256&SignatureVersion=2&Timestamp=2016-11-29T18%3A58%3A52Z&Version=2013-09-01

The results that shows the scratchpad are right.

What I would like to do is to make the request via PHP and elaborate the result.

But If I fist try to put the request on my browser like

https://mws.amazonservices.it/Orders/2013-09-01?AWSAccessKeyId=$CHIAVE_ACCESSO&Action=ListOrders&MarketplaceId=APJ6JRA9NG5V4&SellerId=$SELLER_ID&SignatureMethod=HmacSHA256&SignatureVersion=2&Timestamp=2016-11-29T19%3A13%3A01.000Z&Version=2013-09-01&Signature=Q9Xnr9JhtkzeLUAsCFKPln8SS34FkCQRmELE2WiIhPo%3D&CreatedAfter=2016-10-31T23%3A00%3A00Z

the error is

The Method I used to create the signature was find on stackoverflow and is the following:

$sign  = 'GET' . "\n";
$sign .= 'mws.amazonservices.it' . "\n";
$sign .= '/Orders/2013-09-01' . "\n";
$sign .= $arr;

$signature = hash_hmac("sha256", $sign, $CHIAVE_SEGRETA, true);
$signature = urlencode(base64_encode($signature));

What I'm doing Wrong?

Answer 1

The order of the parameters matters.

Here is some sample code that should give you a good place to start. You'll just need to modify it slightly to fit your system.

class AmazonMWS
{
    private $secretKey = '';

    private $parameters = array();

    /**
     * Constructor for the AmazonMWS class.
     * Initializes constants.
     */
    public function __construct() 
    {
        $this->secretKey = Constant::get('SECRET_KEY');

        $this->parameters['AWSAccessKeyId']     = Constant::get('AWSAccessKeyId');
        $this->parameters['MarketplaceId.Id.1'] = Constant::get('MarketplaceId.Id.1');
        $this->parameters['SellerId']           = Constant::get('SellerId');
        $this->parameters['SignatureMethod']    = Constant::get('SignatureMethod');
        $this->parameters['SignatureVersion']   = Constant::get('SignatureVersion');
    }

    public function setListOrders()
    {
        $this->parameters['Action'] = 'ListOrders';
        $this->parameters['Version'] = '2013-09-01';
        $this->parameters['Timestamp'] = $this->getTimestamp();

        // this part should change and depend on the method/parameter.. for now just for testing

        $this->parameters['CreatedAfter'] = '2015-11-01';
    }

    public function listOrders()
    {
        $request = "https://mws.amazonservices.com/Orders/2013-09-01?";
        $request .= $this->getParameterString($this->parameters) . "&Signature=" . $this->calculateSignature($this->calculateStringToSign($this->parameters));

        echo $request;

        return Curl::fetchSSL($request);
    }

    /**
     * Calculates String to sign.
     * 
     * @param array $parameters request parameters
     * @return String to sign
     */
    protected function calculateStringToSign(array $parameters)
    {
        $stringToSign  = 'GET' . "\n";
        $stringToSign .= 'mws.amazonservices.com' . "\n";
        $stringToSign .= '/Orders/2013-09-01' . "\n";
        $stringToSign .= $this->getParameterString($parameters);

        return $stringToSign;
    }

    /**
     * Gets the query parameters as a String sorted in natural-byte order.
     * 
     * @param array $parameters request parameters
     * @return String of parameters
     */
    protected function getParameterString(array $parameters)
    {
        $url = array();
        foreach ($parameters as $key => $val) {
            $key = $this->urlEncode($key);
            $val = $this->urlEncode($val);
            $url[] = "{$key}={$val}";
        }
        sort($url);

        $parameterString = implode('&', $url);

        return $parameterString;
    }

    /**
     * Computes RFC 2104-compliant HMAC signature.
     *
     * @param String to sign
     */
    protected function calculateSignature($stringToSign)
    {
        $signature = hash_hmac("sha256", $stringToSign, $this->secretKey, true);
        return urlencode(base64_encode($signature));
    }

    /**
     * URL encodes a string.
     */
    protected function urlEncode($string)
    {
        return str_replace("%7E", "~", rawurlencode($string));
    }

    /**
     * Gets the current date as ISO 8601 timestamp
     */
    protected function getTimestamp()
    {
        return gmdate("Y-m-d\TH:i:s.\\0\\0\\0\\Z", time());
    }
}

Answer 2

Have you looked at the PHP client library for the Orders API? I use the C# version, but I would assume the PHP library is similar. Most of the work is done for you.