Critical-risk tools in Shopify Graphql
53 of the 319 tools in Shopify Graphql are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
cancel_fulfillment_orderDestructiveCancel a fulfillment order.
-
cancel_orderDestructiveCancel an order
-
cancel_subscription_contractDestructiveCancel a subscription contract
-
delete_app_proxyDestructiveDelete an app proxy
-
delete_cart_transformDestructiveDelete a cart transform
-
delete_channelDestructiveDelete a sales channel
-
delete_collectionDestructiveDelete a collection
-
delete_companyDestructiveDelete a B2B company
-
delete_company_contactDestructiveDelete a company contact
-
delete_custom_fulfillment_serviceDestructiveDelete a custom fulfillment service
-
delete_custom_pixelDestructiveDelete a custom pixel
-
delete_customerDestructiveDelete a customer from the store
-
delete_customer_addressDestructiveDelete a customer
-
delete_delivery_customizationDestructiveDelete a delivery customization rule
-
delete_delivery_option_generatorDestructiveDelete a delivery option generator
-
delete_discountDestructiveDelete a discount code
-
delete_draft_orderDestructiveDelete a draft order
-
delete_fileDestructiveDelete a file
-
delete_fulfillment_constraint_ruleDestructiveDelete a fulfillment constraint rule
-
delete_locationDestructiveDelete a location from the store
-
delete_marketDestructiveDelete a market
-
delete_marketing_engagementsDestructiveDelete all channel-level marketing engagement data. Marks data such that it no longer appears in reports. Activity-level data cannot be deleted directly - delete the MarketingAc...
-
delete_marketing_eventDestructiveDelete a marketing event
-
delete_menuDestructiveDelete a navigation menu
-
delete_metaobjectDestructiveDelete a metaobject
-
delete_metaobject_definitionDestructiveDelete a metaobject definition. Also deletes all related metafield definitions, metaobjects, and metafields asynchronously.
-
delete_orderDestructivePermanently delete an order. Only certain order types can be deleted. This action is irreversible.
-
delete_packing_slip_templateDestructiveDelete a packing slip template
-
delete_pageDestructiveDelete a page
-
delete_payment_customizationDestructiveDelete a payment customization
-
delete_payment_termsDestructiveDelete payment terms
-
delete_pixelDestructiveDelete a pixel
-
delete_price_ruleDestructiveDelete a price rule
-
delete_productDestructiveDelete a product from the store
-
delete_script_tagDestructiveDelete a script tag
-
delete_themeDestructiveDelete a theme
-
delete_validationDestructiveDelete a validation rule
-
delete_webhook_subscriptionDestructiveDelete a webhook subscription and stop all future webhooks to its endpoint
-
expire_subscription_contractDestructiveExpire a subscription contract
-
remove_line_items_from_orderDestructiveRemove line items from an order
-
remove_translationsDestructiveRemove translations from a resource
-
request_customer_data_erasureDestructiveSubmit a customer data erasure request (GDPR right to be forgotten)
-
revoke_customer_payment_methodDestructiveRevoke a customer
-
add_cash_transactionFinancialAdd a cash transaction to a tracking session
-
capture_order_paymentFinancialCapture payment for an authorized transaction. Use this to claim money that was previously reserved by an authorization.
-
create_gift_cardFinancialCreate a new gift card
-
create_payment_customizationFinancialCreate a new payment customization
-
create_payment_termsFinancialCreate new payment terms
-
create_refundFinancialCreate a refund for an order. Supports refunding line items, shipping costs, and processing refunds through different payment methods.
-
create_shopify_payments_alternate_currency_payoutFinancialCreate an alternate currency payout for a Shopify Payments account
-
create_subscription_contractFinancialCreate a new subscription contract
-
debit_gift_cardFinancialDebit (deduct) from a gift card. Creates a debit transaction that decreases the gift card balance.
-
debit_store_credit_accountFinancialDebit funds from a store credit account
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.