SP-API Updates: Solution Provider Portal Agreement and Policy Updates, BR Store ShipperTrackingNumber Validation, and Listings Attribute and Enumeration Values Changes

This week's SP-API updates include updates to the Data Protection Policy, Solution Provider Portal Agreement, and Acceptable Use Policy, ShipperTrackingNumber field validation enforcement for the Brazil Amazon store, and August updates to Listing attribute usage and enumeration values.

• Solution Provider Portal Agreement and Policy Updates
• ShipperTrackingNumber Field Validation Enforcement for Brazil Amazon Store
• August updates to Listing attribute usage and enumeration values

Solution Provider Portal Agreement and Policy Updates

Starting August 25, 2026, the Data Protection Policy, Solution Provider Portal Agreement, and Acceptable Use Policy will be updated for all Solution Providers. Most changes formalize existing security expectations, but some may require updates to your current security controls.

What's changing?

The Data Protection Policy now requires a web application firewall for internet-facing endpoints, storage encryption on all devices, a 15-minute screen lock, and a 30-minute lockout after ten failed login attempts. You must also designate an incident management point of contact, encrypt all credentials at rest, delete information within 30 days when required, and meet expanded vulnerability scanning and penetration testing requirements, including for APIs.

The Solution Provider Portal Agreement clarifies that actions performed on behalf of customers are accurate, complete, and policy-compliant. We've also clarified when you must maintain insurance coverage and revised the Solution Provider Portal Agreement's reference to the Agent Policy to remove redundancies.

The Acceptable Use Policy now includes a quality and performance standard for submissions made on behalf of authorized users and expands the throttling-circumvention prohibition.

Which Amazon stores are affected?

This change applies to all Amazon stores.

Who is affected?

Developers with applications that access the Solution Provider Portal are affected by this change.

What action is required?

If you have an application that is affected by this change, be sure to:

• Review the updated Data Protection Policy, Solution Provider Portal Agreement, and Acceptable Use Policy before August 25, 2026 to understand how these updates apply to your business.
• Update your current security controls to comply with the new Data Protection Policy requirements, including implementing a web application firewall, storage encryption, screen lock, and lockout policies.
• Designate an incident management point of contact as required by the updated Data Protection Policy.

Note that continued use of the Selling Partner API (SP-API) after August 25, 2026 means you accept the updated agreement and policies.

For more information

To view the updated documents, refer to Policies and Agreements .

ShipperTrackingNumber Field Validation Enforcement for Brazil Amazon Store

Starting August 11, 2026, the ShipperTrackingNumber field must contain only the actual carrier tracking number for seller-fulfilled (MFN) orders in Brazil. URLs and special characters are no longer accepted and will be silently rejected.

Previously, some integrators sent tracking URLs (for example, <https://tinyurl.com/4kxskfsx> or <https://carrier.com.br/rastreio/123>) in the ShipperTrackingNumber field as a workaround to provide buyers with tracking visibility. This practice is no longer supported. Special characters such as ://, /, ., and ? are rejected by the validation system. When the field contains a URL, the tracking information is silently discarded and the buyer receives no tracking update.

Which Amazon stores are affected?

This change applies to the Brazil Amazon store.

Who is affected?

Developers with applications that submit shipment confirmations via the POST_ORDER_FULFILLMENT_DATA feed or the confirmShipment API operation for MFN (seller-fulfilled) orders are affected by this change.

What action is required?

If you have an application that is affected by this change, be sure to:

• Update the ShipperTrackingNumberfield to contain only the actual carrier tracking number (alphanumeric, no special characters, 1–50 characters). Do not send URLs, TMS IDs, ERP IDs, or any identifier other than the real carrier tracking code.
• Send the correct CarrierCode from the Amazon XSD catalog. The value is case-sensitive and space-sensitive. If the carrier is not listed in the XSD, use Other.
• Include the CarrierName field with the carrier's name. This field is mandatory when CarrierCode is Other and recommended in all cases.

August updates to Listing attribute usage and enumeration values

Effective August 31, 2026, Amazon will update the attribute usage and enumeration values of numerous product types across Amazon stores. These adjustments eliminate redundant attributes and improve the curation of attributes and enumeration values that apply to the corresponding product types.

For a complete list of metadata changes and affected Amazon stores, refer to SP-API product metadata changes .

Who is affected?

Both private and public developers using the Listings API and JSON_LISTINGS_FEED feed type to create and edit products with offers are affected by this change. Product-only listings and XSD/XML feed uploads are not affected by this change.

What action is required?

This change takes effect when you create or edit listings for products with offers. It requires you to provide values for the newly added attributes with required usage. For attributes with optional usage, you can choose to provide values. You can choose to use enumeration from the new list in the dropdown values for attributes if the new enumeration is more relevant to the product you are selling.