Inconsistency between REST api scope and GraphQL api scope for ORDERS_CREATE topic

[Fabrice]

Hi,

I was trying to register a webhook with the GraphQL API for the topic ORDERS_CREATE (scopes read_orders) with the following request:

mutation webhookSubscriptionCreate($topic: WebhookSubscriptionTopic!, $webhookSubscription: WebhookSubscriptionInput!) {
    webhookSubscriptionCreate(topic: $topic, webhookSubscription: $webhookSubscription) {
        userErrors { field message }
        webhookSubscription { id }
    }
}
variables: {
   "topic": "ORDERS_CREATE",
   "webhookSubscription": {
      "callbackUrl": "https://webhook.site/...",
      "format": "JSON",
      "includeFields": [],
      "metafieldNamespaces": []
   }
}

When I got this error message:

"data": {
        "webhookSubscriptionCreate": {
            "userErrors": [
                {
                    "field": [
                        "webhookSubscription"
                    ],
                    "message": "You cannot create a webhook subscription with the specified topic"
                }
            ],
            "webhookSubscription": null
        }
    }

First, I thought it was an error in my query, so I tried with another topic and everything worked well.

So, I tried to register to the orders/create webhook with the REST API  using the same API key, same scope (read_order), same store:

POST https://myshop.myshopify.com/admin/api/2020-01/webhooks.json
{
  "webhook": {
    "topic": "orders/create",
    "address": "https://webhook.site/...",
    "format": "json"
  }
}

I'm currently able to subscribe to the webhook with the REST API.

I then decided to test the GraphQL request with the scopes read_order and write_order.

With the new scope write_order I'm able to register my webhook.

So, why do we need the read_order and write_order scopes in GraphQL webhook while we just need the scope read_order to register to the orders/create webhook with the REST API ?

We don't want to add the write_order scope in our app as we don't need it and can scare some client...

Can something be done for this issue ?

Does others webhooks has this inconsistency between the REST API and GraphQL API scopes?

Thanks!! =)

[hassain]

Hey @Fabrice ,

Thanks for bringing this up. This is a known issue on our end, and our developer teams are looking into this. I'll provide more information when I can. 

[Martin25]

This is also happening with the topic: FULFILLMENTS_CREATE.

Are there any updates expected on this issue?

With kind regards,

Martin