Admin GraphQL API / Deprecation

On metaobject definitions,
PRIVATE / PUBLIC_READ is being deprecated

MetaobjectAdminAccess Two enum values are being deprecated. These values 'no longer reflect reality,' and the API will stop returning them. No required action is needed, but updating your code keeps things clear and prevents future access issues.

On this page
  1. What's actually changing (30-second overview)
  2. Diagram: Two values disappearing from API responses
  3. Scope of impact and whether action is required
  4. Why this change is being made
  5. 5 key points for developers
  6. 3 practical use cases
  7. One-line summary for proposals

1What's actually changing

Used for access control on metaobject definitions, MetaobjectAdminAccess from the enum,PRIVATE and PUBLIC_READ the two valuesdeprecatedare being marked as such.
These are values that 'are no longer in use and won't be returned by the API.'No required changes, but cleaning up your code keeps things clear.

Before: Two values existed

PRIVATE and PUBLIC_READ remained on the enum, but didn't accurately reflect the actual behavior (= ambiguous).

Now: Deprecated and no longer returned

Both values are deprecated as obsolete.The API will no longer return them. The ambiguity is removed.

2Diagram: Two values disappearing from API responses

Previous enum definition PRIVATE PUBLIC_READ Other values (not specified in the article) Both values didn't match actual behavior = ambiguous Deprecation Going forward (API 2026-10 release) PRIVATE PUBLIC_READ never returned The API no longer returns these two values Removes ambiguity. No required changes
The value to use instead, or the replacement enum value, is not stated in this article (not documented).Check the official MetaobjectAdminAccess documentation for the specific replacement values.

3Scope of impact and whether action is required

ItemWhat the article says
Target enum MetaobjectAdminAccess
Values being deprecated deprecated PRIVATE / PUBLIC_READ
API behavior These values are no longer returned(never returned)
Required action None "There are no required changes"
Recommended action Update your code (helps maintain clarity and prevent access issues)
Related tags Admin GraphQL API 2026-10
Removal date Not stated
Replacement values / migration steps Not stated
"No required action," butcode written assuming the old values(passing them as mutation inputs or branching on them in responses) could lead to unintended access behavior if left as-is — that is the point of the article.

4Why this change is being made

?

Removing ambiguity

The two deprecated valuesdid not accurately reflect the intended access behavior. Leaving them in place causes confusion about what they actually do.

Maintaining clarity and prevention

Updating your code lets youmaintain clarity and prevent potential access issuesdown the line, according to the article.

55 key points for developers

×2

1. Only two enum values are affected

MetaobjectAdminAccess of PRIVATE and PUBLIC_READ are being deprecated. The enum itself is not going away.

2. Branches on the return value effectively become dead code

The API will no longer returned.access.admin in the return value of PRIVATE/PUBLIC_READ branches that check this are no longer reachable.

3. No required action (optional)

"no required changes." No urgent migration is needed. However, updates are recommended for clarity and prevention.

DOC?

4. The article does not list a replacement value

What to replace it with isnot specified. When fixing places that pass these two values as input, verify valid values in the official enum documentation.

IN OUT

5. Inspect both "input" and "output" sides

Input= places that hardcode these two values in metaobject definition create/update mutations under access.admin .Output= places that read these two values from query return values and branch on them. Both are subject to inventory. The target API version on the tag is 2026-10.

6Three use cases you can apply to your work

USE CASE 1

Codebase audit: surface hardcoded old enum values

Problem
Legacy integrations may still have places that pass access.admin to PRIVATE / PUBLIC_READ directly in metaobject definition create/update mutations.
Action
Full-text search the repository with PRIVATE / PUBLIC_READ to locate places passing it as input for metaobject-related operations. Replace with a valid value (not stated in the article = check the official enum documentation).
Impact
Not required, but keeps the code clear and prevents future misinterpretation of access behavior.
Technical note
The API no longer returns these two values, so unless you fix the input side, it is unlikely to surface on the client. That is exactly why actively hunting down "buried specifications" is the key.
USE CASE 2

Clean up return-value branches in integration apps (dead code removal)

Problem
External systems or internal tools branch their processing based on access.admin in the return value of PRIVATE / PUBLIC_READ metaobject definition queries.
Action
Since these values are no longer returned, the corresponding conditional branches are unreachable. Safely remove them and rewrite the logic to assume the values currently returned.
Impact
Removing unreachable code paths reduces hotbeds for bugs and makes review and maintenance lighter.
Technical note
Not required, but doing the inventory at the same time as the work to bump the target API version to 2026-10 avoids duplicated effort.
USE CASE 3

Managed operations: impact explanation and targeted regression testing

Problem
We maintain metaobject configurations across many stores, and need to explain to clients that this change won't break things, while avoiding unnecessary rework.
Approach
Communicate that the impact is limited based on "no required action," whileaccess.admin narrowing regression testing to only the spots where these are hardcoded.
Outcome
Avoid a full overhaul while addressing only the risky spots. Also reusable as supporting material for explanations and estimates.
Technical notes
Test coverage should include both "mutations that pass the two values as input" and "queries that evaluate the two values in output." Since no removal date is specified, permanent remediation can be set at medium priority.

7One-line summary for proposals

"MetaobjectAdminAccess 's PRIVATE / PUBLIC_READ are deprecated. The API no longer returns them.
Required action is zerobut if you just audit the input/output spots where these are hardcoded, you can maintain clarity and prevent future access issues."