403 The api_client does not have the required permission(s)

Hi,

I am in the process of changing my fulfillment endpoints from the deprecated ones to the new ones, as per Shopify’s request. I have added all of the necessary scopes, however, I am still receiving a 403 error that reads:

errors=The api_client does not have the required permission(s).

I have provided my request body and headers below for your reference. Please let me know if you require any other details. I have taken a look at the Help Center and found no suitable solutions.

Here is my request data:

POST https://jmatestshop.myshopify.com/admin/api/2022-07/fulfillments.json HTTP/1.1
Host: jmatestshop.myshopify.com
X-Shopify-Access-Token: 9a9b05c9ff981a4135342fea9969289b
Connection: Keep-Alive
Content-Type: application/json
Content-Length: 360

{“fulfillment”:{“tracking_info”:{“number”:“1Z9999999999999999”,“company”:“UPS”,“url”:“http://wwwapps.ups.com/etracking/tracking.cgi?InquiryNumber1=1Z9999999999999999&TypeOfInquiryNumber=T&AcceptUPSLicenseAgreement=yes&submit=Track”},“line_items_by_fulfillment_order”:[{“id”:“10232237916203”,“fulfillment_order_id”:“3958452289579”}],“order_id”:“3958452289579”}}

Here are my headers:

HTTP/1.1 403 Forbidden
Date: Mon, 06 Feb 2023 17:58:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Sorting-Hat-PodId: 42
X-Sorting-Hat-ShopId: 2981797
Vary: Accept-Encoding
Referrer-Policy: origin-when-cross-origin
X-Frame-Options: DENY
X-ShopId: 2981797
X-ShardId: 42
X-Stats-UserId:
X-Stats-ApiClientId: 686865
X-Stats-ApiPermissionId: 353038663723
X-Shopify-API-Version: 2022-07
HTTP_X_SHOPIFY_SHOP_API_CALL_LIMIT: 1/40
X-Shopify-Shop-Api-Call-Limit: 1/40
Strict-Transport-Security: max-age=7889238
X-Shopify-Stage: production
Content-Security-Policy: default-src ‘self’ data: blob: ‘unsafe-inline’ ‘unsafe-eval’ https://* shopify-pos://; block-all-mixed-content; child-src ‘self’ https:// shopify-pos://; connect-src ‘self’ wss:// https://*; frame-ancestors ‘none’; img-src ‘self’ data: blob: https:; script-src https://cdn.shopify.com https://cdn.shopifycdn.net https://checkout.shopifycs.com https://api.stripe.com https://mpsnare.iesnare.com https://appcenter.intuit.com https://www.paypal.com https://js.braintreegateway.com https://c.paypal.com https://maps.googleapis.com https://www.google-analytics.com https://v.shopify.com ‘self’ ‘unsafe-inline’ ‘unsafe-eval’; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=create&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Ffulfillments&source%5Bsection%5D=admin_api&source%5Buuid%5D=ea70fb09-9593-4559-9c0e-8ddd64f7bb23
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=create&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Ffulfillments&source%5Bsection%5D=admin_api&source%5Buuid%5D=ea70fb09-9593-4559-9c0e-8ddd64f7bb23
X-Dc: gcp-us-east1,gcp-us-central1,gcp-us-central1
X-Request-ID: ea70fb09-9593-4559-9c0e-8ddd64f7bb23
CF-Cache-Status: DYNAMIC
Report-To: {“endpoints”:[{“url”:“https://a.nel.cloudflare.com/report/v3?s=7lLpEtBW5ulvLqxFUgshBJy39Q%2BhyQAdLKsb3P69ZhKilmBCuogJNoWnojkNJG%2F%2Bc9MbGGbAN27gBrYSyx0QlWu91tFq3f4u7HrCXajDJ%2FLkarL0v2MraMUAtU7YDhj67INq5NHoCXnTlyo%3D”}],“group”:“cf-nel”,“max_age”:604800}
NEL: {“success_fraction”:0.01,“report_to”:“cf-nel”,“max_age”:604800}
Server-Timing: cfRequestDuration;dur=153.000116
Server: cloudflare
CF-RAY: 7955c6e5adcaad34-ATL
alt-svc: h3=“:443”; ma=86400, h3-29=“:443”; ma=86400

45
{“errors”:“The api_client does not have the required permission(s).”}
0

Thanks

I faced the same issue. in my case, i figured out that there are two missing scopes that are not mentioned in the docs. they are:

  • write_assigned_fulfillment_orders
  • write_merchant_managed_fulfillment_orders