The Toronto and London company, a 2023 Techstars graduate, follows a $4m seed from December 2025. It says revenue grew almost tenfold in a year and counts L'Oréal, Unilever and Mars as customers.
Shopify switches off its Global Catalog REST API on 2 November
EditorialBy TrustList Editorial
All calls to discover.shopifyapps.com/global fail from that day, saved catalogs included; apps must move to Global Catalog MCP, while the new Shop MCP adds carts and Shop Pay checkout for agents.
About Shopify switches off its Global Catalog REST API on 2 November
Shopify switches off its Global Catalog REST API on 2 November
9 October 2026: Shopify's Global Catalog REST API, deprecated in April 2026, stops serving traffic on 2 November 2026. From that day every request to discover.shopifyapps.com/global fails, including requests against saved catalogs, and apps that search or look up products across Shopify merchants through it must have moved to Global Catalog MCP, which implements the Universal Commerce Protocol.
Not yet independently verified. This rests on Shopify's own developer changelog; we found no independent report, and Shopify does not say how many apps still call the REST API. We will update this when it can be confirmed, and remove this note.
Which calls stop working
Shopify's changelog lists four endpoints that go dark:
- GET /global/v2/search
- GET /global/v2/p/{upid}
- GET /global/v2/p/by-variant/{vid}
- POST /global/v2/lookup
Each has a replacement tool on the MCP server at catalog.shopify.com/api/ucp/mcp. Search maps to search_catalog, the two single-product lookups map to get_product, passing a product or variant global ID, and bulk lookup maps to lookup_catalog, which takes up to 50 items per request. Requests must include the agent's profile URL in meta.ucp-agent.profile, saved catalogs are addressed by passing their ID in the request rather than through a dedicated URL, and responses follow the UCP catalog schemas. Authentication does not change.
Shop MCP: the agent-facing side
Four days after the deprecation notice, on 13 October, Shopify published Shop MCP, a single connection at mcp.shop.com with 17 tools for AI agents. It covers search over a catalog Shopify puts at more than a billion products, with no API key needed for search; sign-in with Shop so search uses a shopper's saved sizes and preferences; carts and checkout on Shopify stores, including Shop Pay once the shopper confirms the total; checkout on non-Shopify stores, where the shopper approves the purchase in Shop and the agent receives single-use card details; and order tracking. Shopify says nothing changes for existing Catalog API integrations and no action is needed for Shop MCP itself.
Taken together, the two notices show where Shopify wants product discovery to happen: through MCP servers that AI agents call, rather than a conventional REST API.
What app developers should do now
Teams that built price comparison, product search or affiliate tools on the REST API have under three weeks. The work is mostly mechanical, a change of endpoint, request shape and response schema, but it touches every search and lookup call, so it needs testing against saved catalogs before 2 November rather than on the day.
Shopify in our catalogue
We list Shopify as a company, and our B2B ecommerce platform category lists 10 products.
Related on TrustList:
Sources
Categories & features
- Canada
- Ontario,
- Ottawa, Canada
- eCommerce
- API
- Application Development
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
MISA-2026-0009 closes a Node-RED admin bypass rated 8.8 in V1R2.5.1. MISA-2026-0010 says that release is still exposed to the Brotli decoder flaw, with dozens of Mitel products under investigation.
Cyber Centre alert AL26-028 says callers posing as IT staff push employees, mostly at legal and financial firms, to branded fake sign-in pages that relay passwords and MFA in real time, then steal SharePoint and OneDrive data for extortion.
The German retail and technology group Schwarz leads. Cohere has not said how much the first close raised, and plans to fold in Aleph Alpha and the security start-up AISLE within a year.
The high-rated flaw, CVE-2026-92392, is a use-after-free in HTTP/2 uploads affecting curl 8.12.0 to 8.22.0; the other 23 are rated low, and several leak credentials across origins.
The Toronto company, formerly called ProPay, emerges from stealth with two named home warranty customers and plans to move into extended and OEM warranty.
At least three quarters of the price is cash. DoorDash says it will keep Instacart's enterprise technology for grocers and promises no grocery exclusivity, but closing is not expected before the end of 2027.
The Montreal search vendor adds a Y Combinator-backed San Francisco start-up whose agents pull product attributes from spec sheets and PDFs. Anglera customers stay on their platform; terms were not disclosed.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More CanadaThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.