# Unlisted page

This page is unlisted. Search engines will not index it, and only users having a direct link can access it.

## On this page

This documentation for the Shopify System Detection integration describes the technical capabilities of this integration, including authorization, scopes/permissions, and utilized endpoints. For more information on how to integrate Shopify System Detection, visit our [connection instructions](https://docs.datagrail.io/docs/integrations/connection-instructions/shopify_system_detection).

## Version

This integration utilizes the Shopify System Detection GraphQL Admin API **2026-01**.

## Base URL

The base URL used for all Shopify System Detection API endpoints contains the **Shop Name** and **API Version**:

```
https://shopname.myshopify.com/admin/api/version/graphql.json
```

## Authentication & Authorization

The DataGrail Shopify System Detection integration connects using **OAuth 2.0** with the following credentials: **Client ID** and **Client Secret**.

**Sensitive Credentials**  
Publicly exposing your API credentials can allow unauthorized access to Shopify System Detection API endpoints by a third party. DataGrail stores your API credentials encrypted and protected.

### Scopes

The Shopify System Detection integration requires specific scopes that _must_ be granted in order to function for a given capability.

| Scope | Base | System Detection |
| --- | --- | --- |
| `read_apps` | ✅ | ✅ |

**Base Scopes**  
All base scopes must be granted in order to connect the integration with DataGrail. The remaining scopes are only required if enabling those capabilities.

#### Endpoints Utilized

DataGrail uses the following endpoints to authorize and test the connection:

| Method | Endpoint | Purpose | Docs |
| --- | --- | --- | --- |
| GET | `https://shopname.myshopify.com/admin/oauth/access_scopes.json` | Access scopes granted to the app on this store |  |
| POST | `https://shopname.myshopify.com/admin/oauth/access_token` | Get and refresh access token |  |
| GET | `https://shopname.myshopify.com/admin/oauth/authorize` | Request authorization |  |

## Limits

Limits in Shopify System Detection are calculated using the leaky bucket algorithm. All requests that are made after rate limits have been exceeded are throttled and an `HTTP 429 Too Many Requests` error is returned. Requests succeed again after enough requests have emptied out of the bucket.

- DataGrail supports requests throttling to stay within 70-80% of specified service rate limits.
- DataGrail processes API responses with HTTP 429 status to interrupt requests, waiting and retrying (using an exponential backoff strategy).

## Capabilities

### System Detection

DataGrail provides continuous system detection, delivering a real-time inventory of your data assets.

#### Data Interactions

DataGrail's **System Detection** process runs once daily and performs the following actions:

1. List of **AppInstallation** objects.
2. Process application installation data to identify and classify third-party applications in use on the Shopify store.

#### Endpoints Utilized

| Method | Endpoint | Purpose | Docs |
| --- | --- | --- | --- |
| POST | `/graphql.json` | List of AppInstallation objects |  |

## Need help?

If you have any questions, please reach out to your dedicated Account Manager or contact us at [support@datagrail.io](mailto:support@datagrail.io).

*Disclaimer: The information contained in this message does not constitute as legal advice. We would advise seeking professional counsel before acting on or interpreting any material.*