Starting today, Shopify has added a new gatekeeper for bulk operations in the GraphQL Admin API. If you build public or custom partner apps that run bulk queries or bulk mutations, you’ll need to enable the appropriate permission in the Partner Dashboard before those calls succeed. This post breaks down the change, tells you exactly who needs to act, and walks you through the steps and code you’ll need to stay compliant.
What Changed
Bulk operations are now split into two distinct permission sets:
bulkOperationRunQuery. - Bulk Mutations – required to call bulkOperationRunMutation. If your app attempts a bulk operation without the matching permission, Shopify returns an access denied error. The rule applies to every GraphQL Admin API version, so it’s not a version‑specific quirk.Who Is Affected
Only apps that are built and published through the Partner Dashboard are subject to this change. That means:
• Public apps listed on the Shopify App Store. • Custom apps you create as a partner for specific merchants. Apps that merchants create directly in the Shopify admin or via the Dev Dashboard remain untouched for now. If your app has already run bulk operations, Shopify pre‑enabled the needed permission. You can verify the status in the Partner Dashboard. However, any app that hasn’t run a bulk query or mutation in the last 31 days loses that specific permission and will need to be re‑enabled.
How to Enable Bulk Operations
mutation RunBulkMutation {
bulkOperationRunMutation(
mutation: "mutation { productUpdate(id: \"gid://shopify/Product/123456789\", tags: \"new, sale\") { product { id } } }"
) {
bulkOperation {
id
status
}
userErrors { field message }
}
}
The code snippet above shows a typical bulk mutation. After you enable bulk mutations in the dashboard, this call will succeed. If the permission is missing, the response will contain an accessDenied error instead of the usual bulkOperation payload.
Best Practices & Common Pitfalls
• Check permission programmatically – Before you fire a bulk operation, you can query the app’s permission status via the GraphQL appInstallation endpoint. If it’s missing, log a clear warning and skip the operation.
• Automate re‑enabling – Set up a cron job that calls the Partner API’s appPermissionsUpdate endpoint (if you have API access) to re‑grant bulk permissions after a 31‑day lull.
• Separate concerns – If your app mixes queries and mutations, enable both permissions from the start. This avoids a surprise “access denied” after a future feature rollout.
• Version‑agnostic – Because the rule applies to all Admin API versions, you don’t need to version‑gate this check. One permission toggle covers every future GraphQL version you might upgrade to.
Conclusion & Next Steps
Bulk operations are a powerful tool for moving large data sets, and Shopify’s new permission model keeps that power safe and predictable. Take a few minutes today to verify your app’s bulk‑query and bulk‑mutation settings in the Partner Dashboard, and add a simple permission‑check to your codebase. Doing so will prevent unexpected downtime and keep your merchants’ workflows running smoothly.
Ready to update your app? Head to the Partner Dashboard now, enable the needed bulk permissions, and let your bulk jobs run without interruption.
