Our app’s Dev Dashboard → API health is flagging a deprecated Storefront API call:
As of API version 2026-01, the cartDiscountCodesUpdate mutation will require the discountCodes argument.
Endpoint: CartDiscountCodesUpdate.discountCodes · Storefront · GraphQL
The issue: our code never calls cartDiscountCodesUpdate anywhere. We’ve searched our entire codebase and confirmed it — we don’t use this mutation at all. Yet it keeps getting reported against our app.
Our questions:
- Attribution: How is a Storefront API deprecation attributed to an app? What exactly causes a call to be counted against our app in the API-health report?
- Source store: The API-health report is aggregate (endpoint + last-detected only). Is there any way — dashboard, Admin API, webhook, or Partner support — to see which shop(s) the flagged call came from? That would let us narrow it down.
- Impact if ignored: What actually happens at the 2026-01 cutoff for a call we don’t make? Could our app get marked “Fix overdue” / face delisting because of it, even though it’s not in our code?
- Anyone else? Is anyone else seeing a Storefront deprecation (especially
cartDiscountCodesUpdate) attributed to their app for a call they don’t make? How did you investigate or resolve it?
Any guidance from Shopify staff or other partners would be much appreciated.
Thanks!
Hey @Rohan_Vasava, good questions! As of the 2026-01 Storefront API version, cartDiscountCodesUpdate requires the discountCodes argument. Before that, a call omitting it was accepted but was effectively a no-op, so this often shows up from older calls that previously did nothing.
API health reflects any call made with your app’s access tokens in the last 14 days, not just calls from your app’s own server code. For a Storefront mutation like this, that means anything sending your app’s Storefront access token counts toward your status, for example a theme app extension or app embed, a headless storefront using the token, or even testing via an HTTP client like Postman or Insomnia. So your code never calling the mutation directly and the warning still appearing are not contradictory.
There’s no self-serve breakdown of which store or request triggered it, but our support team can check the logs on our side and trace the offending call back to a store/user agent etc. I’d reach out to Shopify Partner support and include your app’s client ID and the exact warning you’re seeing so they can correlate it.
Thanks Donal, Would you need anything from my side to trace to the offending caller?
No problem! Once you’re logged in with an account associated with the Partner organization that owns the app in question support will have a lot of context already. If you could share a link to the affected app as it appears in your Dev Dashboard along with the above screenshot that’d save them some time!
These are the apps which has the warning in the dashboard. The last deprecated call date/time is different for all three apps so I’m assuming there are multiple stores who are making these calls.
I’m also interested to know that how can we prevent them from using our tokes, like can we restrict the token to be used only in certain APIs types or something like that?
Just following up on this, is there any update or guidance available? I’m still seeing the deprecation warnings across the three apps and would really appreciate any pointers on how to identify the source store(s). Thanks so much for your help!
