GraphQL Admin API / Behavior change

Bulk Operations in Partner apps
can now run only when access has been granted in advance

Bulk queries and bulk mutations each require access to be enabled in the Partner Dashboard; otherwise they return an access denied error. This applies to all API versions. Apps that haven't used a given type in the last 31 days lose access to it.

On this page
  1. What's changing (30-second overview)
  2. How it works: what happens before a bulk operation runs
  3. Bulk queries and bulk mutations are enabled separately
  4. Which apps are affected, and which aren't
  5. Existing apps and the 31-day rule
  6. How to enable access (3 steps)
  7. 5 key points for developers
  8. 3 practical use cases
  9. One-line summary for proposals

1What's changing

Until now, any app could call bulk operations in the GraphQL Admin API directly.
Starting today, only apps that have enabled access to bulk operations in the Partner Dashboard can run bulk queries and bulk mutations.

Before: just call it and it runs

No prior approval in the Partner Dashboard was needed to start a bulk operation.

Now: prior approval required

Bulk queries and bulk mutations each need access. Starting one without it returns an access denied error.

2How it works: what happens before a bulk operation runs

Partner app bulkOperationRunQuery bulkOperationRunMutation Runs on any store GraphQL Admin API All API versions are affected Access enabled for that operation type? Partner Dashboard settings Yes No Run bulk operation Processed as before access denied error Requests are rejected
Access is granted per app , and applies to all stores that have the app installed. No per-store setup is required.
The article doesn't specify the exact error codes or response format.

3Bulk queries and bulk mutations are allowed separately

Read operations

Bulk queries

bulkOperationRunQuery require access to bulk queries .

Partner Dashboard button: "Allow bulk queries"

Write operations

Bulk mutations

bulkOperationRunMutation require access to bulk mutations .

Partner Dashboard button: "Allow bulk mutations"

Enabling one doesn't enable the other.Every operation type your app actually usesmust be enabled.

4Affected and unaffected apps

Affected

Public apps

Public apps developed by Partners that run bulk operations.

Affected

Custom apps built by Partners

Custom apps developed by Partners that run bulk operations.

Not affected for now

Merchant-built apps

Apps created by merchants in the Shopify admin or Dev Dashboard. Not affected "for now."

ItemDetails
Applies to APIGraphQL Admin API (bulk queries / bulk mutations)
Applies to API versionsAll versions Applies even if you're pinned to an older version
Start dateEffective from the publication date (2026-11-06)
Behavior without permissionaccess denied error
Access scopeAll stores where the app is installed

5Existing apps and the "31-day rule"

Ran in the last 31 days → access already enabled automatically 31 days after the last run Loses access for that operation type Re-enable in the Partner Dashboard * Bulk queries and bulk mutations are evaluated independently

Apps already using bulk operations

Shopify has already enabled access. You can check the status in the Partner Dashboard.

Operation types unused for 31+ days

Apps that haven't run a bulk query or bulk mutation in the last 31 days lose access to that operation type. You can restore it by re-enabling it.

6How to enable (3 steps)

1

Select the app under Apps

Open "Apps" in the Partner Dashboard and select the app.

2

Click "API access requests"

Open it from the sidebar menu.

3

Allow under "Run bulk operations"

Click "Allow bulk queries", "Allow bulk mutations", or both, as needed.

No need to change app settings, release a new version, or ask merchants to reinstall.
Operation types that are already enabled show as "Enabled" in that section.

75 key points for developers

Q M

1. Queries and mutations are separate permissions

bulkOperationRunQuery and bulkOperationRunMutation require separate access. Audit which ones your codebase calls.

ALL ver

2. Pinning an API version won't get around it

The requirement applies to all versions of the GraphQL Admin API. Older versions return access denied just the same.

31d

3. Watch for dormancy expiry on infrequent jobs

Operation types unused for the last 31 days lose access. For jobs that run only occasionally, such as monthly or quarterly migration batches, check the status in the Partner Dashboard before running them.

4. Handle errors explicitly

Without permission, requests return access denied. The article doesn't specify the exact error code or format, so make sure your logs and alerts can catch failed bulk operation starts.

5. Resolved entirely from the dashboard

No app setting changes, new version releases, or merchant reinstalls are needed, and the permission applies to every store where the app is installed.an operational task with no deployment— that's how you can treat it. Merchant-created apps (admin / Dev Dashboard) are currently out of scope.

83 practical use cases

USE CASE 1

Audit bulk access across your Partner apps

Challenge
You maintain multiple public and custom apps as a Partner, and you don't have full visibility into which apps use bulk queries or mutations.
Approach
Inventory all bulkOperationRunQuery/bulkOperationRunMutation calls in your code, and cross-check them against each app's enabled status under "API access requests" in the Partner Dashboard.
Impact
Prevents sudden batch failures caused by access denied errors.
Technical note
Queries and mutations are enabled separately. Don't miss cases where only one of them is enabled.
CALENDAR 31
USE CASE 2

Add a pre-run check to your monthly and seasonal batch procedures

Challenge
Some bulk jobs run more than 31 days apart, such as month-end price updates or annual large-scale data exports, so access may have lapsed by the time they run.
Approach
Add a preliminary step to your batch runbook: "Check whether Run bulk operations is enabled in the Partner Dashboard, and click Allow if it isn't."
Impact
Avoids failed bulk updates at critical moments, such as right before a sale.
Technical note
Re-enabling doesn't require changing app settings, releasing a new version, or reinstalling. It takes just a few clicks.
access denied
USE CASE 3

Set up monitoring and alerts for failed bulk starts

Challenge
Because bulk operations run asynchronously, a rejected start can go unnoticed, and missing data syncs are only discovered later.
Approach
When the response to a bulk start request indicates access denied, send an alert to your notification channel with instructions to re-enable access in the Partner Dashboard.
Impact
Shortens recovery time after access expires and minimizes the impact on merchants.
Technical note
The article doesn't specify the exact error code or message format. Check actual responses before defining your detection criteria.

9One-line summary for proposals

"Bulk queries and bulk mutations from Partner apps are rejected on all API versions unless they're approved in advance in the Partner Dashboard.
Apps already using them are approved automatically, but access expires after 31 days of non-use.
Fixing it takes just a few clicks in the dashboard, with no deployment or reinstall required."