Shopify surface
Identify whether shopify metafields and metaobjects belongs to the Admin GraphQL API, Storefront API, a webhook subscription, a Function, Flow, or an app-owned service. Each surface has different trust, execution, and version contracts. Use typed definitions, namespaces, references, validation, ownership, and publication rules.
Access and version
Document installation context, token type, header, scopes, protected data needs, and API version for typed custom data, definitions, references, ownership, and publication. Authentication identifies the caller; authorization still has to be enforced for the requested action.
Cost and async state
Account for calculated GraphQL query cost, pagination, bulk-operation state, webhook delivery, or queue capacity as applicable. Ad hoc keys become an undocumented schema shared by themes, apps, and staff.
Commerce reconciliation
Verify products, variants, orders, inventory, customers, or fulfillments reached the intended Shopify and external states. HTTP 200 can still contain GraphQL errors, and successful receipt is not final business proof.