Working with Timestamps

The timestamp (or expiration time) you use in an Amazon Marketplace Web Service (Amazon MWS) request must be a dateTime object. A best practice is to provide the timestamp in Coordinated Universal Time (UTC) in ISO 8601 date time format, such as "2009-03-03T18:12:22Z" or "2009-02-23T18:12:22.093-07". The Timestamp attribute must contain the client's machine time in ISO 8601 date time format; requests with a timestamp significantly different (15 minutes) than the receiving machine's clock will be rejected to help prevent replay attacks. For more information about timestamps in XML, see http://www.w3.org/TR/xmlschema-2/#dateTime.

Every Amazon MWS response includes a Date header in its HTTP response that you can use to check whether your local machine's time matches our server's time, such as Date: Tue, 24 Mar 2009 20:34:28 GMT You can also load the Amazon MWS address https://mws.amazonservices.com/ in any Web browser (no request is needed) to receive a response with the current Amazon MWS server time:

<?xml version="1.0"?>
<PingResponse>
  <Timestamp timestamp="2009-03-24T20:29:19:22Z"/>
</PingResponse>

Here are a few additional considerations when working with timestamps:

• In order to allow Amazon MWS to extend the content of the PingResponse, any software you write to parse the Timestamp should not break if sibling XML tags start to appear. Generally, you should ignore unknown tags in any XML Amazon MWS sends you, as per the web architectural principle in Section 5.2 of http://www.w3.org/TR/webarch/.
• If you specify a timestamp (instead of an expiration time), the request automatically expires 15 minutes after the timestamp. In other words, Amazon MWS does not process a request if the timestamp is more than 15 minutes earlier than the current time on Amazon MWS servers. Amazon MWS also does not process a request if the timestamp is more than 15 minutes later than the current time on Amazon MWS servers. Make sure your server's time is set correctly.
• If you are using .NET, you must not send overly specific timestamps, due to different interpretations of how extra time precision should be dropped. To avoid overly specific timestamps, manually construct dateTime objects with no more than millisecond precision.