Skip to main content
Unlisted page
This page is unlisted. Search engines will not index it, and only users having a direct link can access it.

Shopify

Authentication & Authorization​

Credentials​

  • Shopify connects via OAuth 2.0 with authorization code grant flow.
  • Connection depends on your Shopify Store Name. See Shopify Connection Instruction.
  • DataGrail uses Refresh Token Flow to periodically update access token after it expires to keep the connection alive.
  • DataGrail owns a Shopify Public App that provides the credentials to authenticate customers allowing the integration to connect by simply logging into their Shopify store with their admin credentials and accepting to install the app.

Scopes​

Shopify API requires specific scopes that need to be approved by you in order to grant DataGrail read/write on certain objects necessary to complete privacy requests. See Shopify Connection Instruction.

The next scopes are required and should be set to connect DataGrail integration:

  • read_customers

Additionally, depending on the required integration capabilities, DataGrail requires the following scopes to be set:

Access​

  • read_orders
  • read_all_orders
  • read_checkouts
  • read_content
  • read_assigned_fulfillment_orders

Deletion​

  • write_customers
  • write_orders
  • write_customer_data_erasure

Responsible Data Discovery (RDD)​

  • read_orders
  • read_all_orders
  • read_checkouts
  • read_content

Base URL​

API base URL is dynamic and depends on the customer's Shopify shop name. It contains your sub-domain: shopname.myshopify.com and API version:

Example of BASE URL: https:​//datagraildev.myshopify.com/admin/api/2024-01

Endpoints Utilized​

  • Request authorization:
    • GET https://{shopname}.myshopify.com/admin/oauth/authorize
  • Get and refresh access token:
    • POST https://{shopname}.myshopify.com/admin/oauth/access_token
  • Validate that credentials are good based on a successful response:
    • GET {BASE_URL}/customers/count.json

Version​

Shopify integration currently supports REST and GraphQL Admin API version 2024-01.

Limits​

Shopify API rate limits are based on the combination of the app and store. This means that calls to one store don't affect the rate limits of another store, even from the same app.

Limits in Shopify are calculated using the leaky bucket algorithm. All requests that are made after rate limits have been exceeded are throttled and an HTTP 429 Too Many Requests error is returned. Requests succeed again after enough requests have emptied out of the bucket.

  • DataGrail supports requests throttling to stay within 70-80% of specified service rate limits.
  • DataGrail processes API responses with HTTP 429 status to interrupt requests, waiting and retrying (using an exponential backoff strategy).

Access​

For an access request, DataGrail will take the following actions:

Endpoints Utilized​

  • GET {BASE_URL}/customers/search.json
  • GET {BASE_URL}/orders.json
  • GET {BASE_URL}/orders/{order_id}/transactions.json
  • GET {BASE_URL}/orders/{order_id}/refunds.json
  • GET {BASE_URL}/orders/{order_id}/risks.json
  • GET {BASE_URL}/orders/{order_id}/fulfillments.json
  • GET {BASE_URL}/orders/{order_id}/fulfillments/{fulfillment_id}/events.json
  • GET {BASE_URL}/orders/{order_id}/fulfillment_orders.json
  • GET {BASE_URL}/checkouts.json
  • GET {BASE_URL}/checkouts/{checkout_id}/payments.json
  • GET {BASE_URL}/blogs.json
  • GET {BASE_URL}/comments.json
note

DataGrail also supports the Direct Contact Access workflow for Shopify integration.

Deletion​

For a deletion request, DataGrail will take the following actions:

Step 1. Deleting customer profiles​

  • Search for Customers by the Data Subject email.
  • If a match is found, fetch all orders related to the customer.
  • Update all found orders:
    • Datagrail updates orders to make them anonymized, unrelated to the customer.
    • Your orders will remain in Shopify without affecting your reporting and available to be used accordingly for tax, audit or any other legal requirement purposes related to your company and/or industry.
  • Delete customer profile.

Shopify customer profiles deletion has a lot of restrictions. Customer profiles can't be deleted in the following cases:

  • The customer has an order history.
  • The customer has pending redaction because of a GDPR erasure request.
  • The customer has an active subscription now, or if the customer ever had a subscription in the past.
  • The customer is the recipient of a scheduled gift card that hasn't been delivered yet.

Step 2. Request erasing a customer’s personal data​

If customer profile deletion failed, DataGrail will initiate Erasing a customer’s personal data:

Step 3. Erasing a customer’s personal data​

By default, Shopify won't erase personal data if the customer has made an order in the last six months (180 days) in case a chargeback occurs. If a request for erasure is submitted during that time, the request in DataGrail will remain in a pending state until the required time has passed and data can be deleted. When the required time has passed, Shopify completes the erasure request. To override this processing delay, please contact Shopify Support.

You may manage the status of the DataGrail request to erase Shopify data via the connection option: Deletion Behavior (see Shopify Connection Instruction):

  • If you select Mark integration as complete when a deletion request is successfully submitted:
    • DataGrail will send the deletion request to Shopify and mark the request as successfully completed within DataGrail. DataGrail will not create a scheduling task to ensure data has been deleted.
  • If you select Continue processing until the deletion request is completed (default behavior):
    • DataGrail will create a scheduling task for regular checking of customer status in Shopify using the "retrieves a single customer" call.
    • Deletion request will be in the processing status on DataGrail side until Shopify erases the requested personal data.

Endpoints Utilized​

  • GET {BASE_URL}/customers/search.json
  • GET {BASE_URL}/orders.json
  • PUT {BASE_URL}/orders/{order_id}.json
  • DELETE {BASE_URL}/customers/{customer_id}.json
  • GET https://{shopname}.myshopify.com/admin/oauth/access_scopes.json
  • POST {BASE_URL}/graphql.json
  • GET {BASE_URL}/customers/{customer_id}.json

Responsible Data Discovery​

Data discovery is based on the principle of finding any and all personal data that's stored in a data system.

Currently, DataGrail integration discovery the next Shopify objects:

For discovery requests, DataGrail will take the following actions:

  • Count number of all records for each of supported objects.
  • Fetch records examples for each of the supported object.
  • Sampling data for the next analysis and classification.

Endpoints Utilized​

  • GET {BASE_URL}/customers/count.json
  • GET {BASE_URL}/orders/count.json
  • GET {BASE_URL}/checkouts/count.json
  • GET {BASE_URL}/customers.json
  • GET {BASE_URL}/orders.json
  • GET {BASE_URL}/checkouts.json
  • GET {BASE_URL}/tendertransactions.json
  • GET {BASE_URL}/customers/{customer_id}/metafields.json
  • GET {BASE_URL}/orders/{order_id}/metafields.json
  • GET {BASE_URL}/orders/{order_id}/transactions.json
note

DataGrail also supports the Direct Contact Deletion workflow for Shopify integration.

 

Need help?
If you have any questions, please reach out to your dedicated CSM or contact us at support@datagrail.io.

Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.