Release identity
SHA-256 of the pack file bytes: da52f85adb3a6e7afb3a13788698fa6c18122db3876147f73745446d60190020
Not in the distributable release manifest. The binary carries a digest-bound manifest of the distributable library; a pack whose bytes differ from its manifest entry — endpoint, tier, allowlist, or credential edited, with provider, version, and review block preserved — fails the digest check, loses distributability, and renders MODIFIED rather than as the shipped reviewed artifact. Review state and artifact status are different facts: the first is a documentation-review declaration, the second is the identity of the exact bytes.
Capabilities (5)
shopify.orders.read v1.0.0R0
- Action
- read
- Endpoint
GET https://shopify-store.invalid/admin/api/2026-07/orders.json- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-shopify-admin-token- Data class
- financial
Retrieve a list of orders (filterable by status and date). Order records carry totals, payment status and transaction references (financial data) alongside customer names, emails, phones and addresses (personal data), and Shopify treats them as protected customer data; the resource is registered at the financial class. The registered path covers the collection read only — single-order reads and the order count endpoint are not registered by this pack.
shopify.customers.read v1.0.0R0
- Action
- read
- Endpoint
GET https://shopify-store.invalid/admin/api/2026-07/customers.json- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-shopify-admin-token- Data class
- pii
Retrieve a list of customers: names, email addresses, phone numbers, addresses and marketing-consent state — personal data, registered at the pii class and treated by Shopify as protected customer data. The registered path covers the collection read only — single-customer reads, customer search, customer order history and the customer count endpoint are not registered by this pack.
shopify.products.read v1.0.0R0
- Action
- read
- Endpoint
GET https://shopify-store.invalid/admin/api/2026-07/products.json- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-shopify-admin-token- Data class
- internal
Retrieve a list of products with variants, prices, tags and publication state — the store's internal catalogue, registered at the internal class. The registered path covers the collection read only — single-product reads and the product count endpoint are not registered by this pack.
shopify.orders.refunds.read v1.0.0R0
- Action
- read
- Endpoint
GET https://shopify-store.invalid/admin/api/2026-07/orders/ORDER_ID/refunds.json- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-shopify-admin-token- Data class
- financial
Retrieve the list of refunds for one order: refund amounts, restock instructions and refund transactions — records of money returned to customers, registered at the financial class. ORDER_ID is a placeholder the deployment binds to a concrete order before enabling. The registered path covers the collection read only — single-refund reads are not registered by this pack.
shopify.orders.refunds.create v1.0.0R3
- Actions
- create, pay, send
- Endpoint
POST https://shopify-store.invalid/admin/api/2026-07/orders/ORDER_ID/refunds.json- Connector
- http
- Custody
- customer_vault
- Credential ref
secret-ref-shopify-admin-token- Data class
- financial
Create a refund for one order. Three effects must be read separately. First, the call creates the refund object: the 201 response records a new Refund resource with its line items and restock instructions. Second, the request submits refund transactions to the payment gateway (typically produced by the refunds/calculate endpoint, whose suggested_refund kind must be changed to refund before the refund is accepted); each submitted transaction has its own processing outcome, recorded per transaction, so a 201 confirms the refund object was created and the transactions were submitted — it is not a universal guarantee that every transaction settled or that funds reached the customer, and the caller confirms individual outcomes with the refunds read this pack registers. Third, the request's notify option emails a refund notification to the customer, an outbound customer communication the caller controls per request. The actions are therefore create, pay and send at the R3 floor — pay and send are among the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer). The registered cost ceiling is a budget control on the declared amount: the gateway refuses a declared amount above it and commits the ceiling against the work budget; it does not bound the amount the provider request encodes — currency, minor units and restock instructions are the deployment's review. ORDER_ID is a placeholder the deployment binds to a concrete order before enabling. The refunds/calculate endpoint is deliberately not registered: a calculation that moves nothing can be performed by a human in the Shopify admin.
Credential reference
The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.
- Reference
secret-ref-shopify-admin-token- Custody
- customer_vault
- Injection
- header (X-Shopify-Access-Token)
A Shopify Admin API access token held in the client's own secret manager. The stored material must be the complete X-Shopify-Access-Token header value: the token itself, with no scheme. customer_vault is the only generally-supported production custody model here — identity_federation and customer_broker are refused at startup and inline is lab-only. Issuance depends on the app generation, and the two must not be conflated. Supported legacy credentials: apps created directly in the Shopify admin (admin-created custom apps) had Shopify pre-generate a non-expiring Admin API access token at install — Shopify documents that these apps can no longer be created, so that flow applies only to apps the deployment already operates, and it is not available to a new 2026 deployment; such tokens remain valid until the app is uninstalled or the client secret is revoked, and rotation is an external administrative action. Current issuance and renewal flows: a new app is created in the Shopify Dev Dashboard and obtains tokens through a grant — for a server-side integration acting on the organization's own stores, the client credentials grant returns a token valid for 24 hours that is renewed by repeating the same request; embedded and standalone apps use token exchange or the authorization code grant, and Shopify directs public apps to expiring offline tokens (1-hour access token with a 90-day refresh token, and refresh retirements handled by Shopify as new tokens are acquired). Either way an external deployment process MUST mint and renew tokens and write the fresh header value into the vault — the executor injects the stored value verbatim and performs no token lifecycle itself, and a stale value fails closed. Uninstalling the app or revoking the client secret ends a token's access (requests then return 401). Least privilege: grant the token only the scopes these capabilities need — read_orders, read_customers and read_products for the reads, plus write_orders only if the refund-creation capability is enabled — and Shopify requires apps to be approved for protected customer data before order and customer reads return it. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.
Resources
shopify-store-orders(api, financial):https://shopify-store.invalid/admin/api/2026-07/orders.jsonshopify-store-customers(api, pii):https://shopify-store.invalid/admin/api/2026-07/customers.jsonshopify-store-products(api, internal):https://shopify-store.invalid/admin/api/2026-07/products.json
Pack notes and exclusions
The endpoint host 'shopify-store.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the store's own host before enabling, in the endpoints, the resource locators and the egress allowlist — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. The real substitution shape is '{store}.myshopify.com' (the store's myshopify.com subdomain; myshopify.com subdomains are real vendor hosts but are customer-specific, so the pack ships the reserved pattern). ORDER_ID in the refund endpoint paths is a placeholder too: refunds are sub-resources of one order, so the capability is bound to a concrete order id before enabling. This pack pins the Admin REST API version 2026-07 deliberately: Shopify serves dated versions, and a version bump is a reviewed migration, not a silent edit. This pack registers only endpoints the official REST Admin API reference documents: listing orders, listing customers, listing products, listing an order's refunds, and creating a refund. Reads are collection reads: single-record reads (GET /admin/api/2026-07/orders/{order_id}.json, GET /admin/api/2026-07/customers/{customer_id}.json, GET /admin/api/2026-07/products/{product_id}.json, GET .../refunds/{refund_id}.json) and count endpoints are not registered by this pack. Only the last 60 days of orders are accessible by default; older orders require the read_all_orders scope in addition to read_orders, which is a deployment decision, not a pack default. Documented exclusions: this pack does not register order creation, update, deletion, cancellation, close or re-open (order creation through the API collects no payment, but it still records a customer-facing purchase, and cancellation moves obligations the other way), product creation, update or deletion, customer creation, update, deletion or account-invite sending, fulfillment operations, gift cards, discounts, and the entire GraphQL Admin API — Shopify marks the REST Admin API a legacy API for new public apps, and new deployments should weigh the GraphQL surface under its own review. Refund creation is the one write in the pack because money moves: it is pay at the R3 floor. The review state is draft, not library, for a concrete reason: this pack's custody model — a long-lived Admin API access token held in the customer's vault — has not yet been reviewed against the properties the capability-library plan (docs/gtm/CAPABILITY-LIBRARY-PLAN.md §4) gates any authentication mode on: issuance authority and delegation, scope, audience, TTL, revocation, executor access and bypass paths. That review is unfinished.
Review record
Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)
- https://shopify.dev/docs/api/admin-rest/2026-07/resources/order (retrieved 2026-09-21)
- https://shopify.dev/docs/api/admin-rest/2026-07/resources/refund (retrieved 2026-09-21)
- https://shopify.dev/docs/api/admin-rest/2026-07/resources/customer (retrieved 2026-09-21)
- https://shopify.dev/docs/api/admin-rest/2026-07/resources/product (retrieved 2026-09-21)
- https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens (retrieved 2026-09-21)
A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.