Thanks for the quick response. We're not using the shopify-api-js library in our production codebase. I had read conflicting instructions online about what headers to include in Admin GraphQL API calls, so I thought that using the shopify-api-js library would be the best way to report an easily reproducible bug to your team. I now see that I'm mistaken.
In our codebase, we are using no SDKs and are hitting the GraphQL endpoint directly. I'm still seeing a bug when we do this. It's admittedly a slightly different one (the response back is not the 404 Not Found), but there does still seem to be something wrong with this one single customer/this specific store.
Let me demonstrate using cURL requests that I know for a fact are sending POST requests.
Here are several different permutations of cURL requests with slightly different headers/arguments, and the results they return back on my own store, and on the store for the specific customer for whom we're seeing issues. I've also annotated each with the x-request-id response header.
The following are demonstration-only GraphQL queries. We are not running any of these in production, but I thought that fetching the shop name and nothing else would be a good way to test auth via cURL.
(1) Content type JSON, --data-raw parameter. Works only in my own shop, but not on the customer's shop.
curl -L -i -X POST 'https://SHOPNAME.myshopify.com/admin/api/2023-04/graphql.json' \
-H 'X-Shopify-Access-Token: ...' \
-H 'Content-Type: application/json' \
--data-raw '{"query":"{ shop { name }}"}'
On my own store, the x-request-id is 3c983672-ef13-487b-9507-eee9f4d4ffda and the behavior is a 200 response with valid data.
On the store for the customer facing issues, the first response is a 301 redirecting to a different subdomain (the location header in the response is location: https://AUTOGENERATEDSHOPNAME.myshopify.com/admin/api/2023-04/graphql.json after I made an initial request to the user-selected shop name) with an x-request-id for this first response of dfb8e0f4-7c64-4b96-96e4-ef2666e86eb9. After the 301 redirect, the second response is a 400 response with an x-request-id of 6974628c-b2fc-474c-aa8f-36c349e73ce6 and a body of {"errors":{"query":"Required parameter missing or invalid"}}.
(2) Content type JSON, --data parameter. Works only in my own shop, but not on the customer's shop.
curl -L -i -X POST 'https://SHOPNAME.myshopify.com/admin/api/2023-04/graphql.json' \
-H 'X-Shopify-Access-Token: ...' \
-H 'Content-Type: application/json' \
-d '{"query":"{ shop { name }}"}'
On my own store, the x-request-id is 884c854f-11f7-48ed-ac17-8c2e31cb1c48 and the behavior is a 200 response with valid data.
On the store for the customer facing issues, I see a similar 301-then-400 pattern. The x-request-id of the first response is 9bce450d-5528-4eaa-b318-cbdc80e8257d and of the second is 82681d43-0797-4362-bbf5-5575ab729344. The response body is the same error as before.
(3) Content type GraphQL, --data-raw parameter. Does not work in either shop.
curl -L -i -X POST 'https://SHOPNAME.myshopify.com/admin/api/2023-04/graphql.json' \
-H 'X-Shopify-Access-Token: ...' \
-H 'Content-Type: application/graphql' \
--data-raw '{"query":"{ shop { name }}"}'
On my own store, the x-request-id is 8a57e8f6-002e-4183-adfd-95249484e518 and the behavior is a 200 response returning an error:
{"errors":[{"message":"Parse error on \"query\" (STRING) at [1, 2]","locations":[{"line":1,"column":2}]}]}%
On the store for the customer facing issues, I see a similar 301-then-400 pattern. The x-request-id of the first response is 7dd4471a-0609-4ef5-a64c-f9fff10999bf and of the second is 41787734-260c-4b97-b6ba-831936cebd6e. The response body is the same error as before, {"errors":{"Body missing or invalid":"Required parameter missing or invalid"}}.
(4) Content type GraphQL, --data parameter. Does not work in either shop.
curl -L -i -X POST 'https://SHOPNAME.myshopify.com/admin/api/2023-04/graphql.json' \
-H 'X-Shopify-Access-Token: ...' \
-H 'Content-Type: application/graphql' \
-d '{"query":"{ shop { name }}"}'
On my own store, the x-request-id is b1b981f7-ab01-419e-9484-bb5352a89b09 and the behavior is a 200 response returning an error:
{"errors":[{"message":"Parse error on \"query\" (STRING) at [1, 2]","locations":[{"line":1,"column":2}]}]}%
On the store for the customer facing issues, I see a similar 301-then-400 pattern. The x-request-id of the first response is 37fb3b0e-73a7-4818-b2b5-5d5851484a60 and of the second is 827f9b50-e1e1-41f6-81b0-f954781bbf55. The response body is the same error as before, {"errors":{"Body missing or invalid":"Required parameter missing or invalid"}}.
In summary, even with a POST request (such that we are not hitting the 404 Not Found error caused by using the official SDK), there is still something broken for this one particular customer/one shop. I suspect it has something to do with the 301 redirect that we are seeing only for this store and not for other stores.
