Shopify Requires Explicit Access for Bulk Operations in GraphQL Admin API

What Changed

Shopify now requires partner apps to enable bulk operations access before using the GraphQL Admin API’s bulk query and bulk mutation functionality. This access must be configured in the Partner Dashboard and is managed as two separate permissions:

• Access to bulk queries, required to run bulkOperationRunQuery
• Access to bulk mutations, required to run bulkOperationRunMutation

These permissions are independent of each other. An app can have access to one without the other, depending on its use case. If an app attempts to initiate a bulk operation without the corresponding access enabled, the API request returns an access denied error.

Why This Matters for Shopify App Developers

Bulk operations are commonly used to process large datasets asynchronously, such as exporting product catalogs, syncing order history, or performing mass updates to inventory or metafields. Apps that rely on these operations for core functionality will stop working correctly if access isn’t explicitly enabled, resulting in failed API calls and broken workflows for merchants.

This change adds a gating mechanism to a previously open API capability, giving Shopify more granular control over which apps can execute resource-intensive bulk operations against the Admin API.

Practical Implications

Developers should audit their apps now to confirm whether they use bulkOperationRunQuery or bulkOperationRunMutation. If either is used, the corresponding access must be enabled in the Partner Dashboard before deployment or before existing installations attempt to run these operations.

Teams managing multiple apps across different Partner organizations should check each app individually, since this setting is configured per app. Testing in a development store is recommended to confirm bulk operations return expected results rather than access denied errors after this change takes effect.

Read the full announcement →