Using Soap Without Ws-Security - Amazon Product Advertising API Developer's Manual

Product Advertising API Developer Guide
that contains the X.509 certificate (for example: the URI attribute equals #CertId-1064304 in the
preceding example request).
You must include a wsu:Id attribute in any message elements that you sign. You can sign any
SOAP header and the entire SOAP Body . Do not sign any other elements (such as children of the
Body element). AWS ignores those elements for the purposes of signature validation, even if you
include a wsu:ID attribute in them. If you sign elements that shouldn't be signed, the signature
validation will fail.

Using SOAP without WS-Security

This section describes how to authenticate SOAP requests without using WS-Security. The topics describe
the basic requirements, the required authentication information, and where to place the information in
the SOAP request.
General Requirements
If you plan to use SOAP without WS-Security:
• You can use either SOAP 1.1 or SOAP 1.2
• You must use HTTPS with your requests
Required Authentication Information
Authentication of SOAP requests without WS-Security uses your AWS identifiers and an HMAC-SHA256
signature. The request must include the parameters listed in the following table.
Parameter
AWSAccessKeyId
Timestamp
Signature
Request Authentication
Description
Your AWS Access Key ID. For more information, see
Identifiers (p. 54).
This is a required parameter if you include the Signature parameter. Otherwise
it is optional. There is no default value. The time stamp you use in the request
must be a dateTime object, with the complete date plus hours, minutes, and
seconds (for more information, go to
http://www.w3.org/TR/NOTE-datetime).This is a fixed -length subset of the
format defined by ISO 8601, represented in Universal Time (GMT):
YYYY-MM-DDThh:mm:ssZ (where T and Z are literals).
Important
If you are using .NET you must not send overly specific time stamps,
due to different interpretations of how extra time precision should be
dropped. To avoid overly specific time stamps, manually construct
dateTime objects with no more than millisecond precision.
The HMAC-SHA256 signature calculated from the concatenation of the
Action and Timestamp parameters, using your AWS Secret Access Key
as the key (for information about authentication with HMAC signatures, see
HMAC-SHA Signatures for REST Requests (p.
request to create a queue, the value of the Signature element would be
the HMAC-SHA256 digest of a string like this:
ItemLookup2011-09-24T00:00:00Z
API Version 2011-08-01
71
Your AWS
55)). For example, for a