Access denied for fulfillmentOrders field

Partner Discussions
,
1

If an order parameter is requested that the used app or merchant plan (PII with Basic plan) doesn’t allow acces to the order is returned without the parameter in question. Unfortunately the response also contains an error block stating ACCESS DENIED to the parameter so we have to inspect both error and data to see if it is a complete or partial fail depending on the amount of actual data that is returned…

{
  order(id: "gid://shopify/Order/5959952957618") {
    id
    billingAddress {
      firstName
      lastName
    }
  }
}

Response

{
  "errors": [
    {
      "message": "This app is not approved to use the firstName field. See https://partners.shopify.com/xxx for more details.",
	  ...
],
  "data": {
    "order": {
      "id": "gid://shopify/Order/5959952957618",
      "billingAddress": {
        "firstName": null,
        "lastName": null
      }
    }
  }

However, if we try to request the fulfillmentOrders parameter (among other order fields) then no data at all is returned, not even the “allowed” parameter.

Is that the expected behaviour?

{
  order(id: "gid://shopify/Order/5959952957618") {
    id
    name
    billingAddress {
      firstName
      lastName
    }
    fulfillmentOrders(first: 1) {
      nodes {
        id
      }
    }
  }
}

Response

{
  "errors": [
    {
      "message": "Access denied for fulfillmentOrders field.",
      "locations": [
        {
          "line": 17,
          "column": 5
        }
      ],
...
  ],
  "data": {
    "order": null
  },
...
}
2

Yes — this is expected behavior based on how Shopify handles access scope restrictions.

If you’re missing Personally Identifiable Information access (like billingAddress.firstName), Shopify still returns the order object, redacts the PII fields to null, and includes an error in the errors[] array.

But if you request a field your app isn’t authorized to access at all, like fulfillmentOrders without the right scopes, Shopify returns:

"order": null