retrieve amazon orders including buyer pii using sp-api restricted data tokens

Steps

1. Obtain a standard SP-API access token via LWA as usual, then call the Tokens API `createRestrictedDataToken` endpoint, specifying the `restrictedResources` array with the path and dataElements (e.g., `buyerInfo`, `shippingAddress`) you need.
2. Use the returned `restrictedDataToken` (RDT) in place of the regular access token in the `x-amz-access-token` header for any API calls that return PII.
3. Call the Orders API `getOrders` endpoint to retrieve a list of orders; then call `getOrder` with a specific `orderId` using the RDT to get buyer PII fields like `BuyerEmail` and `ShippingAddress`.
4. RDTs are short-lived (one hour); for batch processing many orders, request a single RDT scoped to the orders resource path and reuse it for all calls within its validity window.
5. Store buyer PII only as long as necessary to fulfill the order and in accordance with Amazon's data protection policies and your Data Protection Policy agreement.
6. Log all RDT creation events for audit purposes without logging the token value or the PII it grants access to.