Purchase Order Read API
- Announced
- Effective
- Tags
- GraphQL-Admin-API
- Severity
- notable, set by
reef/rss-rule-v1 - Source
- https://shopify.dev/changelog/purchase-order-read-api
You can now read purchase orders through the inventoryPurchaseOrder and inventoryPurchaseOrders queries in GraphQL Admin API version 2026-10 and later. This public release lets apps read purchase order details, line items, supplier snapshots, and linked inventory transfers without enrolling shops in the physical inventory feature preview.
Apps using the preview's read_inventory access must obtain purchase order read access.
What changed
Previously, public apps read purchase orders only through the unstable preview. The 2026-10 GraphQL Admin API now exposes:
inventoryPurchaseOrderto retrieve a purchase order by ID, andinventoryPurchaseOrdersto retrieve a paginated list.- Purchase order details and line items, including the supplier name captured in
origin.supplierName. - A paginated
transfersconnection returning the linkedInventoryTransferobjects. Reading these objects also requiresread_inventory_transfersaccess.
InventoryPurchaseOrder.referenceName is not part of the public 2026-10 API. If your preview query selects it, remove that selection before moving to 2026-10.
This is a read-only release. Purchase order mutations are not included. Existing user permissions continue to apply.
Who's affected
- Apps adopting purchase order reads: Request
read_inventory_purchase_orders. Neither API beta access nor shop preview enrollment is required for these reads. - Existing preview integrations:
read_inventoryalone no longer authorizes purchase order reads, including onunstable. Obtainread_inventory_purchase_ordersbefore relying on the released behavior. Keepread_inventoryif your app still needs it for other inventory resources. - Apps already granted purchase order access: No additional purchase order scope request is needed if the installation already has
read_inventory_purchase_ordersorwrite_inventory_purchase_orders, which includes read access. Check your queries against the released field names and types.
Versions 2026-07 and earlier do not gain these public queries. Apps that don't read purchase orders don't need to make changes.
What to do
- Update your app's requested scopes. Add
read_inventory_purchase_orders, and addread_inventory_transfersif you need thetransfersconnection. Preserve any other scopes your app still needs. - Obtain the new grants. Deploy the configuration changes and complete your app's scope approval flow for existing installations. Changing the requested scopes alone does not grant access. Verify the installation's granted scopes through
currentAppInstallation.accessScopes. - Update and test your queries. Target
/admin/api/2026-10/graphql.json, and use the supplier and transfer fields shown below. If you integrate before October 1, 2026,2026-10is a release candidate: use it for testing rather than production. - Check the result on a development store. Use a store with a purchase order and a linked transfer. Confirm the query returns those records without schema-validation or
ACCESS_DENIEDerrors. Check both access scopes and the acting user's permissions if access is denied.
For a Shopify CLI app that needs both purchase orders and their linked transfers, include these scopes in shopify.app.toml:
[access_scopes]
scopes = "read_inventory_purchase_orders,read_inventory_transfers"
Merge these values with your existing scope list rather than replacing it. Apps that already hold the corresponding write scopes don't need to request redundant read scopes.
This example reads the first five purchase orders, with up to five line items and five linked transfers per purchase order:
query PurchaseOrders {
inventoryPurchaseOrders(first: 5) {
nodes {
id
name
status
origin {
supplierName
}
lineItems(first: 5) {
nodes {
id
title
}
}
transfers(first: 5) {
nodes {
id
name
}
}
}
}
}
Paginate each connection to retrieve additional records. If your app doesn't need transfers, omit that selection and the additional transfer scope.
Related docs
The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.