REST and GraphQL APIs permission discontinuity

[sinuhe]

Hi there,

we are definitely migrating from REST API to GraphQL API, as recommended by Shopify on https://www.shopify.com/partners/blog/all-in-on-graphql.

However, there is a field that has always been available with REST API with no permissions and that now requires new permissions. It is the "shop.password_enabled" field in REST API. In GraphQL API, instead of belonging to the "Shop" object like in REST, it belongs to the "OnlineStore" object and it requires a new "read_online_store" permission.

Could you include in the Shop object  with no new permissions to maintain backward compatibility? It will make the migration very complex if we have to ask new permissions to thousands of merchants. Moreover, this field is not to access online store data, it is just to know if there is password protection or not.

Kind regards,

     Fran