Shopify: what this connector can do

Member·5 minutes to read

What this page is for

docs/connectors/shopify.md is the setup guide for whoever runs your organisation's Botseon deployment — creating the vendor application and entering its credentials. This page is the other half: what Shopify actually lets a bot do once it is connected to your account, what it asks you for along the way, its limits, and how to take the connection away again, in Botseon and at Shopify.

Read products, orders, stock, customers, discounts and collections in your shop, and change them with your approval.

What a bot can do with it

Read — Shopify tells a bot things, nothing changes

Tool	What it does
`shopify.list_products`	List products in the shop, newest first, with their variants and prices.
`shopify.get_product`	Read one product by id, including its variants, inventory item ids and price.
`shopify.list_orders`	List orders, optionally filtered by financial or fulfilment status.
`shopify.get_order`	Read one order by id, including its line items, totals and customer.
`shopify.list_customers`	List customers, optionally matching a search query.
`shopify.list_collections`	List the shop’s collections and how many products each holds.
`shopify.list_discounts`	List the shop’s discount codes.
`shopify.get_inventory`	Read the stock level of one inventory item at each location.

Write — Shopify lets a bot change things

Tool	What it does
`shopify.update_product`	Change a product’s title, description, status or a variant’s price.
`shopify.set_inventory`	Set the stock level of one inventory item at one location.
`shopify.create_discount`	Create a discount code, with its value and the dates it runs between.
`shopify.add_to_collection`	Add a product to a collection.
`shopify.update_customer`	Change a customer’s name, email, phone or tags.
`shopify.refund_order`	Refund an order, in full or by amount, back to the original payment method.
`shopify.cancel_order`	Cancel an order.

The permissions it asks for, in plain words

Every call a bot makes through this connector is tagged with what kind of thing it is. Only the tags below ever apply here — a tag this connector's tools never carry is not listed, because it can never ask you for it.

read — Looks something up. Nothing changes, and nothing is sent anywhere. A bot never has to ask first for this.
write — Changes something inside the connected account — creates, edits or files something. Asks you first, unless you have told Botseon to always allow that exact action.
delete — Deletes something you would consider yours. Always asks first — there is no always-allow rule that ever covers this.
spend — Spends your money in the real world. Always asks first — there is no always-allow rule that ever covers this.

Limits

Read products, orders, stock, customers, discounts and collections in your shop, and change them with your approval. Nothing outside that list is possible through this connector, however a bot is asked to use it.

Shopify is also only ever as wide as the scopes your organisation's connected app actually requests — the exact scopes are on the operator's own setup page, docs/connectors/shopify.md, because narrowing or widening them is a decision for whoever runs your deployment, not for this page.

Orders and customers are what Shopify calls protected customer data. If your bot can read your products and stock but stops on orders with "the supplier refused access", the Shopify app your deployment connects through has not been granted that access yet. Nothing you do in Botseon, and no reconnect, changes it: ask whoever runs your deployment to request protected customer data access for the app (step 4 of their setup page).

Disconnecting

In Botseon

Open Plugins from the sidebar, press this connector's card to open its detail page, and under Accounts press the ✕ next to the account (its label is "Remove account" and the name of the account), then Revoke and remove to confirm — or Uninstall to remove the plugin and every account connected to it at once. Either one revokes the stored connection immediately: nothing more is read or changed through it from that moment on. Install a plugin walks through the same screen step by step.

At Shopify

Removing the account in Botseon also asks Shopify to revoke the token, when this deployment's connector is configured with a revoke URL. Confirm the grant is actually gone by opening Shopify's own account settings — the connected-apps, security or authorised-apps page covers it — and removing Botseon there too if it still shows up. That is also where you can revoke access without going through Botseon at all, which is worth knowing if you ever lose access to your Botseon account.

What Botseon keeps, and how your data is used

Whatever a bot reads or writes through this connector becomes part of your conversations and the record of that run — the same records, and the same retention schedule, as everything else a bot works on. Botseon is the processor for that content; your organisation decides what it may read and remember, and can delete it sooner than the schedule would on its own.

Your data is sent to a model provider only to produce the bot's answer, and for nothing else — it is not used to train any model. The Privacy Policy's Models and How long we keep it sections have the full detail, including exactly how long each kind of record is kept for.