Amazon Hijacker Alert via API: Flag Unauthorized Sellers on Your Listing

To flag a hijacker on your Amazon listing via API, allow-list the sellerId values you actually authorize - including "Amazon" itself when Amazon is a legitimate seller on your listing - then poll /amazon-product-offers and report any live seller outside that list, deduped by sellerId since the same seller can show up more than once. A lifetime feedback count from /amazon-seller-review adds a volume signal worth a closer look, but the API has no account-join-date field, so never report it as a verified account age.

What can the API actually tell you about a suspicious seller?

How do I build the allow-list check without overclaiming?

unauthorized_sellers() filters live offers to anything outside your authorized_seller_ids set, deduping as it goes. feedback_volume_signal() reads the lifetime feedback count and flags it low below an arbitrary threshold you choose - it is a lead to investigate manually, not a verdict. get() and new_session() come from the Python quickstart; offer fields are documented in the Offer Listing API guide, seller feedback fields in the Seller Feedback API guide.

hijacker_alert.py - allow-list and a feedback-volume signal

from sellermagnet import get, new_session


def unauthorized_sellers(session, asin: str, marketplace_id: str, authorized_seller_ids: set) -> list[dict]:
    """Live offer sellers NOT in your allow-list, deduped by sellerId (an offer
    list can repeat a seller across delivery dates/fulfillment types - dedupe on
    sellerId, not row count, or you double-count one hijacker)."""
    data = get(session, "amazon-product-offers", asin=asin, marketplaceId=marketplace_id)
    seen, out = set(), []
    for o in data["offers"]:
        sid = o["sellerId"]
        if sid in authorized_seller_ids or sid in seen:
            continue
        seen.add(sid)
        out.append({"sellerId": sid, "sellerName": o["sellerName"], "fulfillmentType": o["fulfillmentType"]})
    return out


def feedback_volume_signal(session, seller_id: str, marketplace_id: str) -> dict:
    """Lifetime feedback volume for a seller - a crude signal for how established
    a seller looks, NOT a verified account age (the API has no join-date field).
    A low lifetime count is worth a closer look, not proof of anything by itself."""
    data = get(session, "amazon-seller-review", sellerId=seller_id, marketplaceId=marketplace_id)
    lifetime = data["feedback"]["reviewsCount"]["lifetime"]
    return {"sellerId": seller_id, "lifetime_feedback_count": lifetime, "low_volume": lifetime < 50}


if __name__ == "__main__":
    session = new_session()
    authorized = {"A1OFFICIAL00"}
    print(unauthorized_sellers(session, "B0CL61F39H", "ATVPDKIKX0DER", authorized))
    print(feedback_volume_signal(session, "A1SUSPECT000", "ATVPDKIKX0DER"))

Example output (illustrative ASIN and sellers)

[{'sellerId': 'A1SUSPECT000', 'sellerName': 'CheapReseller99', 'fulfillmentType': 'FBM'}]
{'sellerId': 'A1SUSPECT000', 'lifetime_feedback_count': 18, 'low_volume': True}

Trimmed offers[] entry (example values)

{
  "sellerId": "A1SUSPECT000",
  "sellerName": "CheapReseller99",
  "fulfillmentType": "FBM"
}

Should I automate takedown requests from this alert?

No - treat this as a detection feed, not an enforcement tool. Report unauthorized_sellers() output to a human review queue (a Slack alert, an inbox item, a dashboard row) and let the brand owner or legal step confirm and act; the API gives you who is selling, not whether they are entitled to.

Bottom line: allow-list by sellerId, dedupe before you count, and treat feedback volume as a lead to check manually rather than proof of a hijacker - the API tells you who is selling, not who is new.