Bulk operations let apps process massive data sets—orders, customers, products—in a single asynchronous request, saving time and API call limits. Shopify just tightened the rules: apps now need explicit permission to run bulk queries or bulk mutations. If you’ve built or installed an app that uses bulkOperationRunQuery or bulkOperationRunMutation, you’ll see an “access denied” error until you enable the appropriate access in the Partner Dashboard. This post breaks down the new requirement, who it affects, and the exact steps you need to take to keep your integrations running smoothly.
What Changed
Previously, any app that could call the GraphQL Admin API could also launch bulk operations without an extra toggle. Shopify now separates bulk queries and bulk mutations into two distinct permissions: • Bulk queries (bulkOperationRunQuery) • Bulk mutations (bulkOperationRunMutation). An app must have the matching permission before the request is accepted. The check applies to every API version, and attempts without permission return a clear “access denied” response. In practice, this means you can enable one permission without the other—useful if your app only reads data but never writes it in bulk.
Who’s Affected
The change targets public and custom apps that you, as a partner, create and publish through the Partner Dashboard. Apps built directly in the Shopify admin or via the Dev Dashboard for a single merchant are exempt for now. If your app already ran bulk operations before the rollout, Shopify pre‑enabled the needed access, but you should verify the settings. Apps that haven’t executed a bulk query or mutation in the past 31 days will automatically lose that permission, forcing you to re‑enable it when you need it again.
How to Enable Bulk Operations
If you’re unsure whether the permission is already active, the same API access requests page shows a green Enabled label next to each operation type. For peace of mind, you can run a quick test query:
graphql
mutation RunBulkQuery {
bulkOperationRunQuery(
query: "{ orders(first: 1) { edges { node { id name } } } }"
) {
bulkOperation {
id
status
}
userErrors { field message }
}
}
If the response includes a bulkOperation ID, your permission is correctly set. If you see an error like "Access denied: bulk queries not enabled", head back to the Partner Dashboard and enable the missing flag.
Action Checklist for Developers
• Open the Partner Dashboard and review your app’s bulk operation settings.
• Enable bulk queries, bulk mutations, or both, matching the features your app uses.
• Run a test GraphQL mutation to confirm the permission works.
• Document the new requirement in your onboarding guide so future developers know to check these toggles.
• If your app lost access after 31 days of inactivity, repeat the enable steps before the next scheduled bulk run.
• Consider adding a health‑check endpoint that pings a lightweight bulk query to verify permissions automatically.
Conclusion & Next Steps
Bulk operations remain one of the most efficient ways to move large volumes of data in Shopify, and the new permission model simply adds a safety layer. By confirming or enabling bulk query and mutation access in the Partner Dashboard, you’ll avoid unexpected “access denied” errors and keep your app’s data pipelines humming. Need help updating your app’s settings or testing the new flow? Drop a comment below or reach out to our Shopify developer community for a quick walkthrough.
