tagsAdd access scope

GraphQL Admin API Troubleshooting
1

Hello, have there been changes to the access scopes recently?

We were developing a feature that uses the tagsAdd - GraphQL Admin mutation for Order, and during development it was working perfectly fine with the app’s access scopes as "read_orders,read_products,read_all_orders"

Now we went to production with it, and were getting Access denied for tagsAdd field. (and also now that I’m checking, the same thing started happening in the staging app on 2026-09-24)

It’s not explicitly stated in the documentation, but now the tagsAdd mutation requires the write_orders scope (for Order; didn’t check other types).

2

That tracks, tags live on the order resource itself so writing them needs write_orders even though tagsAdd looks read-adjacent. Order mutations that touch tags (orderUpdate, draftOrderBulkAddTags) have the same requirement, so this looks like enforcement catching up rather than a real scope change. Worth adding write_orders to your app’s scopes either way since it’ll likely be required going forward.