Shopify Bulk Operations: Check Query and Mutation Access Separately
If your Shopify app uses bulk operations, it is worth checking bulk query and bulk mutation access as two separate things. A bulk export working does not prove that bulk mutations will work too. Shopify’s setup now has two different layers to review: operation-specific Partner Dashboard permissions and, for public apps, an IP allowlist requirement for bulk operations.
What Shopify changed on Nov. 6
According to Shopify, on Nov. 6 it introduced operation-specific bulk permissions in the Partner Dashboard for public apps and partner-built custom apps. Shopify says this change currently excludes merchant-created apps mentioned in the release, applies across all GraphQL Admin API versions, and can be affected by 31-day inactivity for each operation type. Shopify also says you do not need an app release or reinstall for this dashboard-based change to take effect.
In plain terms, query access and mutation access can diverge. A public app that regularly runs bulk catalog exports may still have a seasonal bulk price update fail later if the mutation side has not been used for more than 31 days. That is a separate access check, not a contradiction.
Do not use one successful job as proof for the other
If an export succeeds, that only shows query-style bulk access is available at that moment. It does not prove mutation access. The safest approach is to verify both dashboard switches: one for bulk queries and one for bulk mutations. If your app is public, also confirm that your expected egress IPs are allowlisted for bulk operations.
In the Partner Dashboard, open Apps and select your app. Go to API access requests, then find Run bulk operations to check query and mutation access separately. The separate public-app IP allowlist requirement does not apply to custom apps.
For mutation checks, use only a development store with disposable test records. That helps avoid real merchant changes while you confirm the app can perform the operation. Avoid relying on any single diagnostic result to explain the whole problem. A failed job may come from access settings, allowlist issues, app logic, or something else.
Public apps and the IP allowlist rule
Shopify’s separate public-app IP allowlist rule is also important for bulk operations. Shopify says public apps must enable IP allowlists before use, with the relevant deadline noted by Shopify as Nov. 12 at 11:59 p.m. ET for public app bulk operations. Treat that as a distinct requirement from the Nov. 6 operation-specific permissions change.
If you are debugging a bulk workflow, check three things in order: the query permission, the mutation permission, and the IP allowlist status for the servers that should make the request. That gives you a clearer picture of expected egress without assuming one test covers everything.
Two quick checks for partner app developers
- Can your app still run a bulk query after the Nov. 6 dashboard change?
- Can your app run a bulk mutation separately, using a development store and disposable test records?
If the answers differ, that is a sign to review the two dashboard permissions independently and then confirm the public-app allowlist for the environment that should be calling Shopify.
Official source: Apps must enable bulk operations before use
Official source: IP allowlists are now required for public apps
