I have some strange behaviour with the admin orders API. We have a service that constructs URLs to fetch orders on request from Shopify. Some are done by the name field, others by order number.
We’ve found if we use name, everything is as expected:
However if we exchange name with order_number (I’ve tried order-number as well) we get every order in the store. It seems that any filtering other than the limit is completely ignored. I’d expect nothing here, instead I’m getting 14MB xml files:
Nothing much going wrong I’d think. Neither of them are documented filters. One works, the other doesn’t. Seeing how both are readonly and name is the same as the order number prefixed with a hash, I’d simply use name for querying and call it a day - or?
I’d expect the API to at least return nothing as opposed to the entire order contents of the store.
However, in my case the name and order-number are different values within this store. Or are you saying order-number is a store configured combination of a prefix and the name field?