Marketplace Offers troubleshooting

Find the message or symptom that you see, then follow the fix.

The Marketplace pages say the feature is disabled

Cause: AWS Marketplace connector is off for your tenant. Every feature starts off. Over the API, every Marketplace call returns 403 FEATURE_DISABLED.

Fix: a tenant owner or admin turns on AWS Marketplace connector under Settings → Features.

AccessDenied on connect

Symptom: after you click Connect on the setup page, it shows Connection failed.

Causes and fixes:

The trust policy does not match. The message has a hint about the trust policy and the ExternalId. Open the role in IAM, then Trust relationships, and check:
- the ExternalId matches the External ID on the setup page exactly, with no spaces;
- every FlowState principal ARN from the setup page is listed.
The role has no permissions, or the wrong ones. The message has no hint. FlowState could use the role but could not list your SaaS products. Deploy the connector again from the setup page. See Trust policy.
The wrong AWS account. You deployed the role in an account that does not hold your seller registration. Check the account in the AWS Marketplace Management Portal, and deploy the role there.

If none of these helps, contact FlowState support with your tenant name and the role ARN.

MCP tools fail with AccessDenied, but the card works

Cause: the trust policy lists only one of the two FlowState principal ARNs.

Fix: deploy the connector again with every FlowState principal ARN from the setup page.

Changeset failed

Symptom: the card shows The changeset failed or Action failed with a reason. Over MCP, get_marketplace_offer_job returns the status failed with the same reason.

Cause: AWS refused the change. FlowState shows AWS’s reason in plain words where it can:

Code	Meaning
`MISSING_MANDATORY_TERMS`	The offer has no legal terms. Choose the standard EULA or a custom EULA.
`INCOMPATIBLE_PRODUCT`	This product does not support that term in a private offer.
`MISSING_PRICE_INCREASE`	A renewal term needs a price increase.
`INCOMPATIBLE_AGREEMENT_START_DATE`	The agreement start date cannot change after the offer is released.
`INVALID_AGREEMENT_START_DATE`	The agreement start date must be after the offer expiration date.
`INVALID_AGREEMENT_TIME_INTERVAL`	The dates are not a supported combination for this product.
`INVALID_SELECTOR_DURATION_VALUE`	The contract duration is outside the allowed range.
`MISSING_AGREEMENT_START_DATE`	This pricing needs an explicit agreement start date.

For other codes, FlowState shows AWS’s own message, or “The changeset failed” with the code.

Fix: correct the value and create the offer again. You cannot edit or resend a failed change.

An action takes a long time

AWS applies each change asynchronously. Most finish in seconds, but some take a few minutes. The card shows a progress line until AWS has finished. Wait, and do not click again.

“No Marketplace connector is configured for this tenant”

Cause: nobody has connected the seller account, or someone disconnected it.

Fix: see Getting started or Reconnect.

The offer form lists no currency, or Change and Expire are missing

Cause: your connector is older than 31 August 2026.

Fix: see Updating the connector.

Using the API or MCP

A create, clone, release, expire, availability change or replacement request over REST needs an Idempotency-Key header. Over MCP, the tools take an idempotency_key argument. If you retry a request, use the same key. A private offer cannot be deleted, so a new key can create or release a second offer.
If a retry with the same key returns 409 with “already in progress”, wait a moment and retry with the same key. If it stays, contact support before you use a new key: the first request may have created an offer already.
A 400 that says a dimension key “is not declared by this product” means that the dimension does not exist for the product. get_marketplace_product lists the valid dimensions.
preview_marketplace_offer checks an offer without sending anything to AWS. Every other call changes your live catalog.