430 Shopify Security Rejection

Shopify's code for a request rejected by its security layer, often too many URLs in a single request.

Status

HTTP/1.1 430 Shopify Security Rejection

Details

Category: 4xx
Status: Unofficial (Shopify). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry only after changing the request

Shopify returns 430 when its platform rejects a request for security reasons rather than for a business rule. A documented trigger is a request containing too many URLs, which the platform treats as abusive.

It is unrelated to any registered code in the 4xx range. Some other stacks have used 430 informally for oversized headers, so read the body rather than assuming.

Common causes

A request carrying an unusually large number of URLs or parameters.
Traffic patterns Shopify's protection layer classified as abusive.

How to fix it

As the client

Split the request into smaller batches.
Reduce request rate and remove anything that looks like scanning behavior.

As the server

Not applicable for callers. On Shopify, review app request patterns against the platform's limits.

Examples

POST /admin/api/2024-01/graphql.json HTTP/1.1
Host: shop.myshopify.com

HTTP/1.1 430 Shopify Security Rejection