I can confirm this behaviour, and I would say this is not a bug. When creating an order through the API, shipping and billing addresses are not required. However, when they are included they require a last name. So when you are leaving out the last name, it will be recognized as incomplete and therefore dropped from the request, which will be created with the rest of the parameters. In most situations this is preferable to failing the order creation, but I can see how it may cause some confusion in a case like this.
Thank you for responding @Ryan
that seems kind of inconsistent.
Is there anywhere these rules are listed? because there is no feedback from the API to let us know that the order was compromised, and we would like to provide assurance to our client that this will not happen again
The bit that doesnt make sense is, you can create an order in the Shopify Admin without giving the customer a last name, and it works fine.
The webhooks push the order and address to our app, and the last name is blank.
Why can you create an order (with no last name in the address) in Shopify, and receive that order (with that address), but you cannot create that exact same order via the API?
I also feel it worth mentioning that as far as I know this behaviour is completely undocumented as well, so we dont know what other fields are required