---
title: "BigCommerce Admin GraphQL metafield and EventBridge fields accept Control Panel user permissions: 2026-10-05 | Harbyn"
description: "BigCommerce Admin GraphQL metafield and EventBridge fields accept Control Panel user permissions, announced Oct 5, 2026."
canonical: "https://harbyn.com/changes/bigcommerce/2026-10-05-control-panel-users-can-use-metafield-and-eventbridge-graphql-fields-with-store"
last-updated: 2026-10-08
---

# BigCommerce Admin GraphQL metafield and EventBridge fields accept Control Panel user permissions

Markdown version of <https://harbyn.com/changes/bigcommerce/2026-10-05-control-panel-users-can-use-metafield-and-eventbridge-graphql-fields-with-store>.

Behavior change - BigCommerce. info severity. In effect.

Control Panel users who are not the store owner can now use the metafield query, deleteMetafield, eventSources, createEventSource, deleteEventSource and reassignMetafieldsOwner when they hold the matching store permission; before, these fields refused every user except the store owner. Single metafield reads are being restricted over the coming weeks to the resource types the user's permissions cover. API account tokens keep the same OAuth scope requirements and the schema is unchanged.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [BigCommerce](https://harbyn.com/vendors/bigcommerce.md) |
| Kind | Behavior change |
| Severity | info |
| Status | In effect |
| Announced | Oct 5, 2026 |
| Added to Harbyn | Oct 8, 2026 |
| Lead time | No dated deadline |
| Review | Reviewed by a person, extracted by a model |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses BigCommerce, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://docs.bigcommerce.com/developer/changelog.md> (changelog, fetched 2026-10-08 17:16 UTC, sha256 `ae3b40fa107f36384eb280a930b724f422b40bbe01df2857699de46f7d5e330e`)

## Related changes

### More from BigCommerce

- [Authorize.net order description format change](https://harbyn.com/changes/bigcommerce/2026-10-05-authorize-net-order-description-fix.md) (Behavior change, announced Oct 5, 2026)
- [Storefront GraphQL returns zero, not null, for price list sale and retail prices of 0](https://harbyn.com/changes/bigcommerce/2026-10-06-price-list-sale-and-retail-prices-of-zero-now-return-zero.md) (Behavior change, announced Oct 6, 2026)
- [301 redirects will apply only to storefront channels](https://harbyn.com/changes/bigcommerce/2026-10-07-301-redirects-now-apply-to-storefront-channels-only.md) (Behavior change, effective Nov 10, 2026)
- [Duplicate Worldpay Access checkout payments now return duplicate\_transaction with HTTP 400](https://harbyn.com/changes/bigcommerce/2026-10-07-clearer-error-for-duplicate-worldpay-access-payments-at-checkout.md) (Behavior change, announced Oct 7, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: ORDER\_CHANGE notifications add PreFulfillmentStatusChange for Amazon Autos](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-3.md) (effective Oct 28, 2026)
- [GitHub: Secret scanning audit log business field changes to enterprise slug](https://harbyn.com/changes/github/2026-10-20-updates-to-github-secret-scanning-7.md) (effective Nov 12, 2026)
- [Jira / Atlassian Cloud: New IP address ranges in use from January 1, 2027](https://harbyn.com/changes/atlassian-jira/2026-10-16-atlassian-cloud-adds-new-ip-address-ranges.md) (effective Jan 1, 2027)
- [Let's Encrypt: Default certificate lifetime changes to 64 days](https://harbyn.com/changes/letsencrypt/2026-10-07-64-day-certificate-lifetimes-coming-feb-2027.md) (effective Feb 10, 2027)

[All upcoming deadlines](https://harbyn.com/deadlines.md)