Currently failing unless: write_customers is granted
This began occurring without any code or configuration changes on our side and is now blocking requests that previously succeeded. Started less than a few hours ago.
Documentation mismatch
The official docs for 2025-04 still indicate that this field should be accessible under read_customers:
Any forum posts indicating that this field’s required scope changed
Context / speculation
The field is described as:
“The URL to unsubscribe a member from all mailing lists.”
Conceptually, it is understandable that Shopify may consider this a write-level capability, since the URL performs a customer-affecting action. However, if this is the case, it appears to be:
A breaking change
Not reflected in current documentation
Not announced via versioning or changelog
Impact
This is disruptive for existing integrations that intentionally avoid requesting write_customers due to its breadth.
Questions
Has the required scope for marketingUnsubscribeUrl changed from read_customers to write_customers?
If so, is this intentional and permanent?
If not, is this a known regression or transient issue?
Will the documentation be updated to reflect the correct requirement?
Any clarification from Shopify would be greatly appreciated, as this affects production integrations and merchant experience.
This seems to have been recent and retroactive - but good to know it is intended and permanent. The reason I say that is that all docs had read_customers on this field no matter the version I was looking at prior to this post. That said, I think understanding what kind of changes can occur retroactively on prior API versions would be helpful.
Are scopes at the object level sticky? i.e., can we see a similar situation to marketingUnsubscribeUrl but at the object level - e.g., Customer?
Is there an alternative place other than Recent changes to Shopify’s platform that these changes can be monitored? FWIW, I do not see anywhere that this field was transitioning from read_customers scope to write_customers scope.
Any additional info you could provide is appreciated! We will assume on our side, unless you say otherwise, that object level scopes (i.e., on the customer object itself) stay consistent for set API versions, but field level scopes may change as we saw here.
The scope should only be required for that field, not the entire object.
RE: keeping up to date with API changes, the changelog is the best place. We missed this one unfortunately but we’re creating a changelog update on this now.
