Question about Shopify Mandatory compliance webhooks

[john-kuo]

hey @kinngh, thanks for your last live help.

I am going through the last part of the submission guideline and it mentioned about the three endpoints
customers/data_request
customers/redact
shop/redact

the endpoints are in the project and have been set up in the app configuration page in the Partner's portal.

The problem is, do you know how to simulate these events? Because the verifyHmac.js is looking for x-shopify-hmac-sha256 in the headers.

Another question is if let's say they requested this webhook customers/data_request with the following payload since my app has scopes to themes, price_rules, and discounts. It says I can return a 200 for now and complete the action within 30 days of receiving the request. Like where do I return the requested data to? According to this guideline here
{ "shop_id": 954889, "shop_domain": "{shop}.myshopify.com", "themes_id": [ 299938, ], "price_rules": { "id": 9999, "id": 2134 } }

thanks

[kinngh]

Hey mate

1. Returning 200: Already done for you here. All you have to do is write your routes in gdpr.js

2. To simulate the webhooks, you can use the Shopify CLI to get this up and running. Here's a template:

shopify webhook trigger --topic=gdpr/topic --api-version=2024-01 --client-secret= --delivery-method=http --address=ngrokurl.com/api/gdpr/topic

The topics are in the GDPR route switch/case statement

[john-kuo]

@kinngh thanks!

I feel like Shopify needs to update its documentation. In their preparation for the submission guide, they only told us to have the three routes, but they never mentioned how to test them..

[kinngh]

I'll submit the feedback so they're aware of it!