shopify_api 16.2.0 → 16.3.1

data/docs/usage/oauth.md

@@ -72,9 +72,9 @@ exchange a [session token](https://shopify.dev/docs/apps/auth/session-tokens) (S
 #### Input
 | Parameter      | Type                   | Required? | Default Value | Notes                                                                                                       |
 | -------------- | ---------------------- | :-------: | :-----------: | ----------------------------------------------------------------------------------------------------------- |
-| `shop`         | `String` | Yes | - | A Shopify domain name in the form `{exampleshop}.myshopify.com`. |
-| `session_token` | `String` | Yes| - | The session token (Shopify Id Token) provided by App Bridge in either the request 'Authorization' header or URL param when the app is loaded in Admin. |
+| `session_token` | `String` | Yes| - | The session token (Shopify Id Token) provided by App Bridge in either the request 'Authorization' header or URL param when the app is loaded in Admin. Its `dest` claim determines which shop receives the token exchange request. |
 | `requested_token_type` | `TokenExchange::RequestedTokenType` | Yes | - | The type of token requested. Online: `TokenExchange::RequestedTokenType::ONLINE_ACCESS_TOKEN` or offline: `TokenExchange::RequestedTokenType::OFFLINE_ACCESS_TOKEN`. |
+| `shop` | `String` | No | `nil` | **Deprecated**, will be removed in v17.0.0. Ignored for the request host; the shop always comes from the session token `dest` claim. If passed, logs a deprecation warning. |
 
 #### Output
 This method returns the new `ShopifyAPI::Auth::Session` object from the token exchange, 
@@ -83,14 +83,13 @@ your app should store this `Session` object to be used later [when making authen
 #### Example
 ```ruby
 
-# `shop` is the shop domain name - "this-is-my-example-shop.myshopify.com"
 # `session_token` is the session token provided by App Bridge either in:
 #   - the request 'Authorization' header as `Bearer this-is-the-session_token`
 #   - or as a URL param `id_token=this-is-the-session_token`
+# The shop is taken from the token's `dest` claim (see session token documentation).
 
-def authenticate(shop, session_token)
+def authenticate(session_token)
   session = ShopifyAPI::Auth::TokenExchange.exchange_token(
-     shop: shop,
      session_token: session_token,
      requested_token_type: ShopifyAPI::Auth::TokenExchange::RequestedTokenType::OFFLINE_ACCESS_TOKEN,
      # or if you're requesting an online access token:

data/lib/shopify_api/admin_versions.rb

@@ -5,6 +5,7 @@ module ShopifyAPI
   module AdminVersions
     SUPPORTED_ADMIN_VERSIONS = T.let([
       "unstable",
+      "2026-10",
       "2026-07",
       "2026-04",
       "2026-01",

data/lib/shopify_api/auth/client_credentials.rb

@@ -22,7 +22,8 @@ module ShopifyAPI
               "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
           end
 
-          shop_session = ShopifyAPI::Auth::Session.new(shop: shop)
+          validated_shop = Utils::ShopValidator.sanitize!(shop)
+          shop_session = ShopifyAPI::Auth::Session.new(shop: validated_shop)
           body = {
             client_id: ShopifyAPI::Context.api_key,
             client_secret: ShopifyAPI::Context.api_secret_key,
@@ -42,7 +43,7 @@ module ShopifyAPI
           response_hash = T.cast(response.body, T::Hash[String, T.untyped]).to_h
 
           Session.from(
-            shop: shop,
+            shop: validated_shop,
             access_token_response: Oauth::AccessTokenResponse.from_hash(response_hash),
           )
         end

data/lib/shopify_api/auth/oauth.rb

@@ -33,6 +33,8 @@ module ShopifyAPI
           end
           raise Errors::UnsupportedOauthError, "Cannot perform OAuth for private apps." if Context.private?
 
+          shop = Utils::ShopValidator.sanitize!(shop)
+
           state = SecureRandom.alphanumeric(NONCE_LENGTH)
 
           cookie = SessionCookie.new(value: state, expires: Time.now + 60)

data/lib/shopify_api/auth/refresh_token.rb

@@ -21,7 +21,8 @@ module ShopifyAPI
               "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
           end
 
-          shop_session = ShopifyAPI::Auth::Session.new(shop:)
+          validated_shop = Utils::ShopValidator.sanitize!(shop)
+          shop_session = ShopifyAPI::Auth::Session.new(shop: validated_shop)
           body = {
             client_id: ShopifyAPI::Context.api_key,
             client_secret: ShopifyAPI::Context.api_secret_key,
@@ -47,7 +48,7 @@ module ShopifyAPI
           session_params = T.cast(response.body, T::Hash[String, T.untyped]).to_h
 
           Session.from(
-            shop:,
+            shop: validated_shop,
             access_token_response: Oauth::AccessTokenResponse.from_hash(session_params),
           )
         end

data/lib/shopify_api/auth/token_exchange.rb

@@ -21,12 +21,12 @@ module ShopifyAPI
 
         sig do
           params(
-            shop: String,
             session_token: String,
             requested_token_type: RequestedTokenType,
+            shop: T.nilable(String),
           ).returns(ShopifyAPI::Auth::Session)
         end
-        def exchange_token(shop:, session_token:, requested_token_type:)
+        def exchange_token(session_token:, requested_token_type:, shop: nil)
           unless ShopifyAPI::Context.setup?
             raise ShopifyAPI::Errors::ContextNotSetupError,
               "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
@@ -36,10 +36,19 @@ module ShopifyAPI
           raise ShopifyAPI::Errors::UnsupportedOauthError,
             "Cannot perform OAuth Token Exchange for non embedded apps." unless ShopifyAPI::Context.embedded?
 
-          # Validate the session token content
-          ShopifyAPI::Auth::JwtPayload.new(session_token)
+          # Validate the session token and use the shop from the token's `dest` claim
+          jwt_payload = ShopifyAPI::Auth::JwtPayload.new(session_token)
+          dest_shop = jwt_payload.shop
+
+          if shop
+            ShopifyAPI::Logger.deprecated(
+              "The `shop` parameter for `exchange_token` is deprecated and will be removed in v17. " \
+                "The shop is now always taken from the session token's `dest` claim.",
+              "17.0.0",
+            )
+          end
 
-          shop_session = ShopifyAPI::Auth::Session.new(shop: shop)
+          shop_session = ShopifyAPI::Auth::Session.new(shop: dest_shop)
           body = {
             client_id: ShopifyAPI::Context.api_key,
             client_secret: ShopifyAPI::Context.api_secret_key,
@@ -74,7 +83,7 @@ module ShopifyAPI
           session_params = T.cast(response.body, T::Hash[String, T.untyped]).to_h
 
           Session.from(
-            shop: shop,
+            shop: dest_shop,
             access_token_response: Oauth::AccessTokenResponse.from_hash(session_params),
           )
         end
@@ -91,7 +100,8 @@ module ShopifyAPI
               "ShopifyAPI::Context not setup, please call ShopifyAPI::Context.setup"
           end
 
-          shop_session = ShopifyAPI::Auth::Session.new(shop: shop)
+          validated_shop = Utils::ShopValidator.sanitize!(shop)
+          shop_session = ShopifyAPI::Auth::Session.new(shop: validated_shop)
           body = {
             client_id: ShopifyAPI::Context.api_key,
             client_secret: ShopifyAPI::Context.api_secret_key,
@@ -120,7 +130,7 @@ module ShopifyAPI
           session_params = T.cast(response.body, T::Hash[String, T.untyped]).to_h
 
           Session.from(
-            shop: shop,
+            shop: validated_shop,
             access_token_response: Oauth::AccessTokenResponse.from_hash(session_params),
           )
         end

data/lib/shopify_api/auth.rb

@@ -1,10 +1,19 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "addressable/uri"
+
 module ShopifyAPI
   module Auth
     extend T::Sig
 
+    # Hostname characters, plus an optional port. Anything else before the first "/" is rejected.
+    EMBEDDED_HOST_AUTHORITY_REGEX = T.let(/\A[a-zA-Z0-9._-]+(:\d{1,5})?\z/, Regexp)
+
+    # Printable ASCII only: no whitespace, control bytes or non-ASCII bytes.
+    EMBEDDED_HOST_ALLOWED_BYTES_REGEX = T.let(/\A[\x21-\x7e]+\z/n, Regexp)
+    private_constant :EMBEDDED_HOST_AUTHORITY_REGEX, :EMBEDDED_HOST_ALLOWED_BYTES_REGEX
+
     class << self
       extend T::Sig
 
@@ -19,8 +28,29 @@ module ShopifyAPI
         end
 
         decoded_host = Base64.decode64(host)
+        unless trusted_embedded_host?(decoded_host)
+          raise Errors::InvalidShopError, "host must decode to a trusted Shopify Admin host"
+        end
+
         "https://#{decoded_host}/apps/#{Context.api_key}"
       end
+
+      private
+
+      sig { params(decoded_host: String).returns(T::Boolean) }
+      def trusted_embedded_host?(decoded_host)
+        return false unless decoded_host.b.match?(EMBEDDED_HOST_ALLOWED_BYTES_REGEX)
+
+        authority = T.must(decoded_host.split("/", 2).first)
+        return false unless authority.match?(EMBEDDED_HOST_AUTHORITY_REGEX)
+
+        uri = Addressable::URI.parse("https://#{decoded_host}")
+        return false unless uri.userinfo.nil? && uri.authority == authority
+
+        !Utils::ShopValidator.sanitize_shop_domain(uri.to_s).nil?
+      rescue Addressable::URI::InvalidURIError
+        false
+      end
     end
   end
 end

data/lib/shopify_api/clients/graphql/storefront.rb

@@ -19,9 +19,10 @@ module ShopifyAPI
             raise ArgumentError, "Storefront client requires either private_token or public_token to be provided"
           end
 
+          validated_shop = Utils::ShopValidator.sanitize!(shop)
           session = Auth::Session.new(
-            id: shop,
-            shop: shop,
+            id: validated_shop,
+            shop: validated_shop,
             access_token: "",
             is_online: false,
           )

data/lib/shopify_api/context.rb

@@ -114,7 +114,11 @@ module ShopifyAPI
 
         unless Dir.exist?(path)
           unless @notified_missing_resources_folder.key?(api_version)
-            @logger.warn("Cannot autoload REST resources for API version '#{version_folder_name}', folder is missing")
+            @logger.warn(
+              "shopify_api #{ShopifyAPI::VERSION} does not bundle REST resources for API version " \
+                "'#{api_version}', so REST resource classes are unavailable. The GraphQL Admin API and " \
+                "the REST client are unaffected.",
+            )
             @notified_missing_resources_folder[api_version] = true
           end
 

data/lib/shopify_api/errors/invalid_shop_error.rb

@@ -0,0 +1,9 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Errors
+    class InvalidShopError < StandardError
+    end
+  end
+end

data/lib/shopify_api/errors/rest_resource_not_loaded_error.rb

@@ -0,0 +1,14 @@
+# typed: strict
+# frozen_string_literal: true
+
+module ShopifyAPI
+  module Errors
+    # Raised when a REST resource class is referenced but this gem version does
+    # not bundle REST resources for the active API version.
+    #
+    # Subclasses NameError so existing `rescue NameError` handling keeps working.
+    # Construct it with the missing constant name - `new(message, name)` - so
+    # NameError#name keeps returning it, matching the NameError Ruby would raise.
+    class RestResourceNotLoadedError < NameError; end
+  end
+end

data/lib/shopify_api/rest/resources/2026_07/abandoned_checkout.rb

@@ -0,0 +1,194 @@
+# typed: false
+# frozen_string_literal: true
+
+########################################################################################################################
+# This file is auto-generated. If you have an issue, please create a GitHub issue.                                     #
+########################################################################################################################
+
+module ShopifyAPI
+  class AbandonedCheckout < ShopifyAPI::Rest::Base
+    extend T::Sig
+
+    @prev_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @next_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    @api_call_limit = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @retry_request_after = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    sig { params(session: T.nilable(ShopifyAPI::Auth::Session), from_hash: T.nilable(T::Hash[T.untyped, T.untyped])).void }
+    def initialize(session: ShopifyAPI::Context.active_session, from_hash: nil)
+
+      @abandoned_checkout_url = T.let(nil, T.nilable(String))
+      @billing_address = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
+      @buyer_accepts_marketing = T.let(nil, T.nilable(T::Boolean))
+      @buyer_accepts_sms_marketing = T.let(nil, T.nilable(T::Boolean))
+      @cart_token = T.let(nil, T.nilable(String))
+      @closed_at = T.let(nil, T.nilable(String))
+      @completed_at = T.let(nil, T.nilable(String))
+      @created_at = T.let(nil, T.nilable(String))
+      @currency = T.let(nil, T.nilable(Currency))
+      @customer = T.let(nil, T.nilable(Customer))
+      @customer_locale = T.let(nil, T.nilable(String))
+      @device_id = T.let(nil, T.nilable(Integer))
+      @discount_codes = T.let(nil, T.nilable(T::Array[T.untyped]))
+      @email = T.let(nil, T.nilable(String))
+      @gateway = T.let(nil, T.nilable(String))
+      @id = T.let(nil, T.nilable(Integer))
+      @landing_site = T.let(nil, T.nilable(String))
+      @line_items = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
+      @location_id = T.let(nil, T.nilable(Integer))
+      @note = T.let(nil, T.nilable(String))
+      @phone = T.let(nil, T.nilable(String))
+      @presentment_currency = T.let(nil, T.nilable(String))
+      @referring_site = T.let(nil, T.nilable(String))
+      @shipping_address = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
+      @shipping_lines = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
+      @sms_marketing_phone = T.let(nil, T.nilable(String))
+      @source_name = T.let(nil, T.nilable(String))
+      @subtotal_price = T.let(nil, T.nilable(String))
+      @tax_lines = T.let(nil, T.nilable(T::Hash[T.untyped, T.untyped]))
+      @taxes_included = T.let(nil, T.nilable(T::Boolean))
+      @token = T.let(nil, T.nilable(String))
+      @total_discounts = T.let(nil, T.nilable(String))
+      @total_duties = T.let(nil, T.nilable(String))
+      @total_line_items_price = T.let(nil, T.nilable(String))
+      @total_price = T.let(nil, T.nilable(String))
+      @total_tax = T.let(nil, T.nilable(String))
+      @total_weight = T.let(nil, T.nilable(Integer))
+      @updated_at = T.let(nil, T.nilable(String))
+      @user_id = T.let(nil, T.nilable(Integer))
+
+      super(session: session, from_hash: from_hash)
+    end
+
+    @has_one = T.let({
+      currency: Currency,
+      customer: Customer
+    }, T::Hash[Symbol, Class])
+    @has_many = T.let({
+      discount_codes: DiscountCode
+    }, T::Hash[Symbol, Class])
+    @paths = T.let([
+      {http_method: :get, operation: :checkouts, ids: [], path: "checkouts.json"},
+      {http_method: :get, operation: :checkouts, ids: [], path: "checkouts.json"}
+    ], T::Array[T::Hash[String, T.any(T::Array[Symbol], String, Symbol)]])
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :abandoned_checkout_url
+    sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+    attr_reader :billing_address
+    sig { returns(T.nilable(T::Boolean)) }
+    attr_reader :buyer_accepts_marketing
+    sig { returns(T.nilable(T::Boolean)) }
+    attr_reader :buyer_accepts_sms_marketing
+    sig { returns(T.nilable(String)) }
+    attr_reader :cart_token
+    sig { returns(T.nilable(String)) }
+    attr_reader :closed_at
+    sig { returns(T.nilable(String)) }
+    attr_reader :completed_at
+    sig { returns(T.nilable(String)) }
+    attr_reader :created_at
+    sig { returns(T.nilable(Currency)) }
+    attr_reader :currency
+    sig { returns(T.nilable(Customer)) }
+    attr_reader :customer
+    sig { returns(T.nilable(String)) }
+    attr_reader :customer_locale
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :device_id
+    sig { returns(T.nilable(T::Array[DiscountCode])) }
+    attr_reader :discount_codes
+    sig { returns(T.nilable(String)) }
+    attr_reader :email
+    sig { returns(T.nilable(String)) }
+    attr_reader :gateway
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :id
+    sig { returns(T.nilable(String)) }
+    attr_reader :landing_site
+    sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+    attr_reader :line_items
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :location_id
+    sig { returns(T.nilable(String)) }
+    attr_reader :note
+    sig { returns(T.nilable(String)) }
+    attr_reader :phone
+    sig { returns(T.nilable(String)) }
+    attr_reader :presentment_currency
+    sig { returns(T.nilable(String)) }
+    attr_reader :referring_site
+    sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+    attr_reader :shipping_address
+    sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+    attr_reader :shipping_lines
+    sig { returns(T.nilable(String)) }
+    attr_reader :sms_marketing_phone
+    sig { returns(T.nilable(String)) }
+    attr_reader :source_name
+    sig { returns(T.nilable(String)) }
+    attr_reader :subtotal_price
+    sig { returns(T.nilable(T::Hash[T.untyped, T.untyped])) }
+    attr_reader :tax_lines
+    sig { returns(T.nilable(T::Boolean)) }
+    attr_reader :taxes_included
+    sig { returns(T.nilable(String)) }
+    attr_reader :token
+    sig { returns(T.nilable(String)) }
+    attr_reader :total_discounts
+    sig { returns(T.nilable(String)) }
+    attr_reader :total_duties
+    sig { returns(T.nilable(String)) }
+    attr_reader :total_line_items_price
+    sig { returns(T.nilable(String)) }
+    attr_reader :total_price
+    sig { returns(T.nilable(String)) }
+    attr_reader :total_tax
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :total_weight
+    sig { returns(T.nilable(String)) }
+    attr_reader :updated_at
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :user_id
+
+    class << self
+      sig do
+        params(
+          since_id: T.untyped,
+          created_at_min: T.untyped,
+          created_at_max: T.untyped,
+          updated_at_min: T.untyped,
+          updated_at_max: T.untyped,
+          status: T.untyped,
+          limit: T.untyped,
+          session: Auth::Session,
+          kwargs: T.untyped
+        ).returns(T.untyped)
+      end
+      def checkouts(
+        since_id: nil,
+        created_at_min: nil,
+        created_at_max: nil,
+        updated_at_min: nil,
+        updated_at_max: nil,
+        status: nil,
+        limit: nil,
+        session: ShopifyAPI::Context.active_session,
+        **kwargs
+      )
+        request(
+          http_method: :get,
+          operation: :checkouts,
+          session: session,
+          ids: {},
+          params: {since_id: since_id, created_at_min: created_at_min, created_at_max: created_at_max, updated_at_min: updated_at_min, updated_at_max: updated_at_max, status: status, limit: limit}.merge(kwargs).compact,
+          body: {},
+          entity: nil,
+        )
+      end
+
+    end
+
+  end
+end

data/lib/shopify_api/rest/resources/2026_07/access_scope.rb

@@ -0,0 +1,62 @@
+# typed: false
+# frozen_string_literal: true
+
+########################################################################################################################
+# This file is auto-generated. If you have an issue, please create a GitHub issue.                                     #
+########################################################################################################################
+
+module ShopifyAPI
+  class AccessScope < ShopifyAPI::Rest::Base
+    extend T::Sig
+
+    @prev_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @next_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    @api_call_limit = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @retry_request_after = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    sig { params(session: T.nilable(ShopifyAPI::Auth::Session), from_hash: T.nilable(T::Hash[T.untyped, T.untyped])).void }
+    def initialize(session: ShopifyAPI::Context.active_session, from_hash: nil)
+
+      @handle = T.let(nil, T.nilable(String))
+      @access_scopes = T.let(nil, T.nilable(T::Array[T.untyped]))
+
+      super(session: session, from_hash: from_hash)
+    end
+
+    @has_one = T.let({}, T::Hash[Symbol, Class])
+    @has_many = T.let({}, T::Hash[Symbol, Class])
+    @custom_prefix = T.let("/admin/oauth", T.nilable(String))
+    @paths = T.let([
+      {http_method: :get, operation: :get, ids: [], path: "access_scopes.json"}
+    ], T::Array[T::Hash[String, T.any(T::Array[Symbol], String, Symbol)]])
+
+    sig { returns(T.nilable(String)) }
+    attr_reader :handle
+    sig { returns(T.nilable(T::Array[T::Hash[T.untyped, T.untyped]])) }
+    attr_reader :access_scopes
+
+    class << self
+      sig do
+        params(
+          session: Auth::Session,
+          kwargs: T.untyped
+        ).returns(T::Array[AccessScope])
+      end
+      def all(
+        session: ShopifyAPI::Context.active_session,
+        **kwargs
+      )
+        response = base_find(
+          session: session,
+          ids: {},
+          params: {}.merge(kwargs).compact,
+        )
+
+        T.cast(response, T::Array[AccessScope])
+      end
+
+    end
+
+  end
+end

data/lib/shopify_api/rest/resources/2026_07/apple_pay_certificate.rb

@@ -0,0 +1,109 @@
+# typed: false
+# frozen_string_literal: true
+
+########################################################################################################################
+# This file is auto-generated. If you have an issue, please create a GitHub issue.                                     #
+########################################################################################################################
+
+module ShopifyAPI
+  class ApplePayCertificate < ShopifyAPI::Rest::Base
+    extend T::Sig
+
+    @prev_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @next_page_info = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    @api_call_limit = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+    @retry_request_after = T.let(Concurrent::ThreadLocalVar.new { nil }, Concurrent::ThreadLocalVar)
+
+    sig { params(session: T.nilable(ShopifyAPI::Auth::Session), from_hash: T.nilable(T::Hash[T.untyped, T.untyped])).void }
+    def initialize(session: ShopifyAPI::Context.active_session, from_hash: nil)
+
+      @id = T.let(nil, T.nilable(Integer))
+      @merchant_id = T.let(nil, T.nilable(String))
+      @status = T.let(nil, T.nilable(String))
+
+      super(session: session, from_hash: from_hash)
+    end
+
+    @has_one = T.let({}, T::Hash[Symbol, Class])
+    @has_many = T.let({}, T::Hash[Symbol, Class])
+    @paths = T.let([
+      {http_method: :delete, operation: :delete, ids: [:id], path: "apple_pay_certificates/<id>.json"},
+      {http_method: :get, operation: :csr, ids: [:id], path: "apple_pay_certificates/<id>/csr.json"},
+      {http_method: :get, operation: :get, ids: [:id], path: "apple_pay_certificates/<id>.json"},
+      {http_method: :post, operation: :post, ids: [], path: "apple_pay_certificates.json"},
+      {http_method: :put, operation: :put, ids: [:id], path: "apple_pay_certificates/<id>.json"}
+    ], T::Array[T::Hash[String, T.any(T::Array[Symbol], String, Symbol)]])
+
+    sig { returns(T.nilable(Integer)) }
+    attr_reader :id
+    sig { returns(T.nilable(String)) }
+    attr_reader :merchant_id
+    sig { returns(T.nilable(String)) }
+    attr_reader :status
+
+    class << self
+      sig do
+        params(
+          id: T.any(Integer, String),
+          session: Auth::Session
+        ).returns(T.nilable(ApplePayCertificate))
+      end
+      def find(
+        id:,
+        session: ShopifyAPI::Context.active_session
+      )
+        result = base_find(
+          session: session,
+          ids: {id: id},
+          params: {},
+        )
+        T.cast(result[0], T.nilable(ApplePayCertificate))
+      end
+
+      sig do
+        params(
+          id: T.any(Integer, String),
+          session: Auth::Session
+        ).returns(T.untyped)
+      end
+      def delete(
+        id:,
+        session: ShopifyAPI::Context.active_session
+      )
+        request(
+          http_method: :delete,
+          operation: :delete,
+          session: session,
+          ids: {id: id},
+          params: {},
+        )
+      end
+
+      sig do
+        params(
+          id: T.any(Integer, String),
+          session: Auth::Session,
+          kwargs: T.untyped
+        ).returns(T.untyped)
+      end
+      def csr(
+        id:,
+        session: ShopifyAPI::Context.active_session,
+        **kwargs
+      )
+        request(
+          http_method: :get,
+          operation: :csr,
+          session: session,
+          ids: {id: id},
+          params: {}.merge(kwargs).compact,
+          body: {},
+          entity: nil,
+        )
+      end
+
+    end
+
+  end
+end