USER_PERMISSION_DENIED with migration to new Google Ads API

[Saurabh Srivastava]

Hey,

Concern - With migration to new Google Ads API from AdWords, we started facing below given error for few of our clients which earlier used to be working fine. Please help me with this.

Error -

Request
-------
MethodName: google.ads.googleads.v9.services.GoogleAdsService/Search
Endpoint: googleads.googleapis.com:443
Headers: {developer-token=REDACTED, linked-customer-id=<Ad-account-id-of-our-client>, x-goog-api-client=gl-java/1.8.0_301 gccl/16.0.3 gapic/16.0.3 gax/2.6.1 grpc/1.27.2}
Body: customer_id: "<Ad-account-id-of-our-client>"
query: "SELECT campaign.id FROM campaign LIMIT 1"
page_size: 1


Response
--------
Headers: Metadata(content-type=application/grpc,request-id=ZA8-dTOO1e9PTiLOMCXaWA,date=Mon, 29 Aug 2022 06:16:36 GMT,alt-svc=h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43")
Body: null
Failure message: errors {
  error_code {
    authorization_error: USER_PERMISSION_DENIED
  }
  message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid"
}
request_id: "ZA8-dTOO1e9PTiLOMCXaWA"

Status: Status{code=PERMISSION_DENIED, description=The caller does not have permission, cause=null}. 

[Google Ads API Forum Advisor]

Hi Saurabh,

Thank you for bringing this up. A full description of account access change from AdWords API is described in our migration Login customer ID guide. 

A visual way to explain access rights in the Ads API is to imagine that the same Google account that generated the refresh token was to access an account in the Ads UI. They will see all the the accounts that List Accessible Accounts returns in the top right drop down list when they click the circle representation of the user in the UI. These are accounts the user has direct access to. If an account in that list is an MCC with child accounts attached, then to see the child accounts they would select that MCC in the top right of the UI and then the child accounts are accessible in the top left - middle accounts drop down list box in the UI. These are the same accounts that Get Account Hierarchy shows. 

To access accounts that are in the top left - middle accounts drop down list box via the API they would put the selected account in the top right list in the UI as login customer Id, and they would put the selected account in the top left - middle accounts drop down list box as the operating customer.

In light of the above, could you send us what is returned by List Accessible Accounts when you get this error?

You may send the requested information via "Reply to author" or via googleadsa...@google.com with a link to this forum post added to the new thread.

Regards,

Aryeh Google Ads API Team

ref:_00D1U1174p._5004Q2docKq:ref