Shopify System Detection

This documentation for the Shopify System Detection integration describes the technical capabilities of this integration, including authorization, scopes/permissions, and utilized endpoints. For more information on how to integrate Shopify System Detection, visit our connection instructions.

Version

This integration utilizes the Shopify System Detection GraphQL Admin API 2026-01.

Base URL

The base URL used for all Shopify System Detection API endpoints contains the Shop Name and API Version:

https://shopname.myshopify.com/admin/api/version/graphql.json

---

Authentication & Authorization

The DataGrail Shopify System Detection integration connects using OAuth 2.0 with the following credentials: Client ID and Client Secret.

Sensitive Credentials

Publicly exposing your API credentials can allow unauthorized access to Shopify System Detection API endpoints by a third party. DataGrail stores your API credentials encrypted and protected.

Scopes

The Shopify System Detection integration requires specific scopes that must be granted in order to function for a given capability.

Scope	Base	System Detection
read_apps	✅	✅

Base Scopes

All base scopes must be granted in order to connect the integration with DataGrail. The remaining scopes are only required if enabling those capabilities

Endpoints Utilized

DataGrail uses the following endpoints to authorize and test the connection:

Method	Endpoint	Purpose	Docs
GET	https://shopname.myshopify.com/admin/oauth/access_scopes.json	Access scopes granted to the app on this store
POST	https://shopname.myshopify.com/admin/oauth/access_token	Get and refresh access token
GET	https://shopname.myshopify.com/admin/oauth/authorize	Request authorization

---

Limits

Limits in Shopify System Detection are calculated using the leaky bucket algorithm. All requests that are made after rate limits have been exceeded are throttled and an HTTP 429 Too Many Requests error is returned. Requests succeed again after enough requests have emptied out of the bucket.

• DataGrail supports requests throttling to stay within 70-80% of specified service rate limits.
• DataGrail processes API responses with HTTP 429 status to interrupt requests, waiting and retrying (using an exponential backoff strategy).

---

Capabilities

System Detection

DataGrail provides continuous system detection, delivering a real-time inventory of your data assets.

Data Interactions

DataGrail's System Detection process runs once daily and performs the following actions:

1. List of AppInstallation objects.
2. Process application installation data to identify and classify third-party applications in use on the Shopify store.

Endpoints Utilized

Method	Endpoint	Purpose	Docs
POST	/graphql.json	List of AppInstallation objects

---