USER_PERMISSION_DENIED,User doesn't have permission to access customer,"errorCode": { "authorizationError": "USER_PERMISSION_DENIED"

[Ananth Sakthivel]

since yesterday my code was working fine and it's fetching the AdsAccount Details through the Service of "GetCustomer()". but today onwards its stop working and throwing the Below error,

Google.Ads.GoogleAds.Lib.GoogleAdsException

  HResult=0x80131500

  Message=Status(StatusCode=PermissionDenied, Detail="The caller does not have permission")

  Source=Google.Api.Gax.Grpc

I have already added the "LoginCustomerId" in my config file. but still, it's not sorted out.

My TestManager CustomerID: 2349150893

Developer token:XXXXXXXXXXXXXX

please have a look on my code below, also I attached the screenshot of my errors.

 try

            {

                Client = new GoogleAdsClient();

                CustomerService = Client.GetService(Services.V0.CustomerService);               

                GoogleAdsServiceClient googleAdsService = Client.GetService(Services.V0.GoogleAdsService);

                    SearchGoogleAdsRequest request = new SearchGoogleAdsRequest()

                    {

                        Query = @"SELECT customer_client.client_customer FROM customer_client",

                        CustomerId = Client.Config.LoginCustomerId

                    };

                    PagedEnumerable<SearchGoogleAdsResponse, GoogleAdsRow> searchPagedResponse = googleAdsService.Search(request);

                    object sync = new Object();

                       

                Parallel.ForEach(searchPagedResponse, response =>

                {

                     lock (sync)

                     {

                         var ClientDetails = CustomerService.GetCustomer(response.CustomerClient.ClientCustomer);//Error at this line

                         if (!ClientDetails.Manager.Value)

                         {

                            

                         }

                     }

                });

            }

[Inspired UM]

I have same issue just with Python lib.  Making request to GoogleAdsService

On Wednesday, 13 February 2019 13:47:25 UTC+2, Ananth Sakthivel wrote:

since yesterday my code was working fine and it's fetching the AdsAccount Details through the Service of "GetCustomer()". but today onwards its stop working and throwing the Below error,

Google.Ads.GoogleAds.Lib.GoogleAdsException

  HResult=0x80131500

  Message=Status(StatusCode=PermissionDenied, Detail="The caller does not have permission")

  Source=Google.Api.Gax.Grpc

I have already added the "LoginCustomerId" in my config file. but still, it's not sorted out.

My TestManager CustomerID: 2349150893

Developer token:XXXXXXXXXXXXXXXXXXX

[pe...@meetweet.nl]

Same here, worked fine this week but now I get the exact same error in the Google Ads Beta API. Using a similar ads.properties (with the old prefix settings) in the old Google Adwords API works fine.

Op woensdag 13 februari 2019 12:47:25 UTC+1 schreef Ananth Sakthivel:

since yesterday my code was working fine and it's fetching the AdsAccount Details through the Service of "GetCustomer()". but today onwards its stop working and throwing the Below error,

Google.Ads.GoogleAds.Lib.GoogleAdsException

  HResult=0x80131500

  Message=Status(StatusCode=PermissionDenied, Detail="The caller does not have permission")

  Source=Google.Api.Gax.Grpc

I have already added the "LoginCustomerId" in my config file. but still, it's not sorted out.

My TestManager CustomerID: 2349150893

Developer token:XXXXXXXXXXXXXXXXXXX

[Charles Astwood]

Me too. I am wondering if there is a fault Googles end as a few of us are seeing this

On Wednesday, 13 February 2019 11:47:25 UTC, Ananth Sakthivel wrote:

since yesterday my code was working fine and it's fetching the AdsAccount Details through the Service of "GetCustomer()". but today onwards its stop working and throwing the Below error,

Google.Ads.GoogleAds.Lib.GoogleAdsException

  HResult=0x80131500

  Message=Status(StatusCode=PermissionDenied, Detail="The caller does not have permission")

  Source=Google.Api.Gax.Grpc

I have already added the "LoginCustomerId" in my config file. but still, it's not sorted out.

My TestManager CustomerID: 2349150893

Developer token:XXXXXXXXXXXXXXXXXXX

[Jordi Puig]

You should check this:

https://ads-developers.googleblog.com/2019/01/new-required-header-for-google-ads-api.html

Regards.

On Wednesday, February 13, 2019 at 5:22:58 PM UTC+1, Charles Astwood wrote:

Me too. I am wondering if there is a fault Googles end as a few of us are seeing this

On Wednesday, 13 February 2019 11:47:25 UTC, Ananth Sakthivel wrote:

since yesterday my code was working fine and it's fetching the AdsAccount Details through the Service of "GetCustomer()". but today onwards its stop working and throwing the Below error,

Google.Ads.GoogleAds.Lib.GoogleAdsException

  HResult=0x80131500

  Message=Status(StatusCode=PermissionDenied, Detail="The caller does not have permission")

  Source=Google.Api.Gax.Grpc

I have already added the "LoginCustomerId" in my config file. but still, it's not sorted out.

My TestManager CustomerID: 2349150893

Developer token:XXXXXXXXXXXXXXXXXXX

please have a look on my code below, also I attached the screenshot of my errors.

[Ethan Lyon]

Has this been integrated into the BigQuery Transfer Service? I'm seeing the same errors there.

--
--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
 
You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwor...@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups "AdWords API and Google Ads API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to adwords-api+unsubscribe@googlegroups.com.
Visit this group at https://groups.google.com/group/adwords-api.
To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/30e348db-7610-43e4-8d74-a3d83b65e11d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[googleadsapi...@google.com]

Hello Everyone,

Thanks for the update, we are looking into the issue. We will be responding on this thread when we find more information.

Regards,
Sai Teja, Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

[Ananth Sakthivel]

Hello Sai,

did you find any solution for my issue?

[pe...@meetweet.nl]

Hello Saj,

Any progress on this issue? Since 11th Feb I can't use the Java examples anymore even after I added the login api.googleads.loginCustomerId setting as described.

Op woensdag 13 februari 2019 17:47:05 UTC+1 schreef googleadsapi-forumadvisor:

[Pavan M Raj Gowda]

I am also facing the same permission issue for the past 2 weeks.

[Dharun SKT]

Hello Sai 

Any progress on this issue? I am also facing the same permission issue from last 2 weeks

Regards,
Dharun.

[vandesa...@gmail.com]

I have the exact same issue, it worked fine until the 10th of Feb, then on the 11th it stopped working.

[rentca...@gmail.com]

I'm having the same issue

Message: Status(StatusCode=PermissionDenied, Detail="The caller does not have permission")

Failure: { "errors": [ { "errorCode": { "authorizationError": "USER_PERMISSION_DENIED" }, "message": "User doesn't have permission to access customer." } ] }

Request ID: f9DUeMOoCpc2vCZMc4jjAQ

Press [Enter] to continue.

[rentca...@gmail.com]

I solved the issue by adding <add key="LoginCustomerId" value="INSERT_LOGIN_CUSTOMER_ID_HERE" /> to my app.config file.

[Ananth Sakthivel]

hi ,

i am reading "Google Ads API" configuration from Web.config file not from app.config. even though i have added that line in my web.config already.but no luck.

this error persists only when i pass the "Client Customerid" into "GetCustomer()". if i pass my manager account id(LoginCustomerid) and its working fine.

[googleadsapi...@google.com]

Hello Everyone,

Looks like some of you have solved the USER_PERMISSION_DENIED error by adding the login-customer-id in the properties file. If you are still facing the issue, could you please go through this blog post and follow the instructions mentioned there to add login-customer-id in the properties file? If you are still facing the issue, could you please go through this blog post and follow the instructions mentioned there to add login-customer-id in the properties file?

Regards,
Sai Teja, Google Ads API Team

Was your question answered? Please rate your experience with us by taking a short survey.

If not -- reply to this email and tell us what else we can do to help.

Take Survey

[Inspired UM]

Hi Sai,

I still have same issue. 
I am using google-ads-python library. I followed instructions in README section of library, used provided template, and specified 'login_customer_id' in google-ads.yaml file, but still have "PermissionDenied: 403 The caller does not have permission" error. The account I want to access has a hierarchy like this:

Main Account/Sub-Account/Sub-sub-Account/Account I want to access. Which ID should go to "google-ads.yaml" file and which to "customer_id" in quety "google_ads_service.search(customer_id, query=query,page_size=1000) "

Thank you

[googleadsapi...@google.com]

Hello Anath,

The other users on this thread added <add key="LoginCustomerId" value="INSERT_LOGIN_CUSTOMER_ID_HERE" /> to their app.config file and was able to fix the issue. Could you please try the same? In general we specify the login-customer-id(to manager authenticating client's account) in the app.config file and then pass the client customer id to the program from which you are pulling the data. if you are still facing the PERMISSON_DENIED error, please share the clientCustomerId and login-customer-id and the user authenticating the call. You could use reply privately to the author option while sharing the details requested.

@Inspired UM

The "Main account"(assuming the user of this account is authenticating the call) CID should be present in the google-ads.yaml file and the clientCustomerId of the "Account" you want to access should be present in the query as customer_id. If you are still facing the PERMISSON_DENIED error, please share the clientCustomerId and login-customer-id and the email address of the user authenticating the call. You could use reply privately to the author option while sharing the details requested.

Regards,
Sai Teja, Google Adws API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

--

--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
 
You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwor...@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups "AdWords API and Google Ads API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to adwords-api+unsubscribe@googlegroups.com.
Visit this group at https://groups.google.com/group/adwords-api.

To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/15d48362-942c-481e-8fc3-2da0ce7493d4%40googlegroups.com.

[pe...@meetweet.nl]

Hello Sai,

Same problem here. I am using the Java client library with an ads.properties file. Before the 11th of Feb it all worked fine. Then, after that date I added the api.googleads.loginCustomerId property as was explained in an earlier Google post. From then on I only get the USER_PERMISSION_DENIED message.

I tried the loginCustomerId of the MCC test account (tried it with and without dashes), which I think should be the id to use right? I also tried the id's of the MCC production account and the test account itself, same thing.

Regards,

Peter

Op maandag 4 maart 2019 21:57:53 UTC+1 schreef googleadsapi-forumadvisor:

[googleadsapi...@google.com]

Hello Peter,

Basically, the loginCustomerId is to specify which user is making calls to the API. If you are making calls on behalf of your client account with the credentials of the user of your manager account, then the manager account CID should be placed as loginCustomerId without dashes in the properties file. If you are making calls to the client account with the credentials of the user of the account itself then in such case loginCustomerId will be the CID of the client account. I tried with my test accounts and this is working fine. Also, it is recommended to upgrade your Java client library to the latest v0.7.0 if not yet upgraded. If you are still facing the PERMISSION_DENIED error. Please share the loginCustomerId, clientCustomerId and the email address of the user authenticating the call along with the request _id of the API call for further investigation. You could use reply privately to the author option while sharing the information requested.

Regards,
Sai Teja, Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[Ananth Sakthivel]

Hello sai,

Please check my previous thread. i have already mentioned that below solution is not working for me.

[pe...@meetweet.nl]

Hi Sai,

A week ago I sent you my credential information and response data in a private message.

Any progress on this issue?

Regards,

Peter

Op woensdag 13 februari 2019 12:47:25 UTC+1 schreef Ananth Sakthivel:

since yesterday my code was working fine and it's fetching the AdsAccount Details through the Service of "GetCustomer()". but today onwards its stop working and throwing the Below error,

[Ananth Sakthivel]

Finally Fixed the Issue. i just updated the library to the stable version(Google.Ads.GoogleAds). then its working fine.

trim empty space if "LoginCustomerId" has.  

[Austin Becker]

Hello,

I am using this 'Get Account Hierarchy' script: https://developers.google.com/google-ads/api/docs/account-management/get-account-hierarchy

What I want is to see the full account hierarchy of accounts to which I have access with my authenticated email address. This script should show me 1) direct access accounts 2) manager accounts 3) sub manager accounts. The above script successfully shows me accounts to which I have direct access. However, it throws the below error on manager accounts:

"
Request made: ClientCustomerId: 3351472384, Host: googleads.googleapis.com:443, Method: /google.ads.googleads.v6.services.GoogleAdsService/Search, RequestId: yd0tvbMgYRXSdHe0a4GL1g, IsFault: True, FaultMessage: User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid

Request with ID 'yd0tvbMgYRXSdHe0a4GL1g' failed with status 'PERMISSION_DENIED' and includes the following errors:
Error with message 'User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid'.
An exception has occurred, use %tb to see the full traceback.
"

I'm not clear on why the error message is that I "don't have permission to access customer." even though I can access this customer via the Google Ads online UI. I understand that I could, instead of using the above script as it is written, I could make a new google-ads.yaml file per manager account and get the sub-accounts that way. But that would be cumbersome. Is there not a way to get all the account hierarchy with the above script?

[Google Ads API Forum Advisor Prod]

Hi Austin,

Thank you for reaching out. This code example would go through the account hierarchy and print them out. If you don’t specify the managerId, then the direct accounts under the authenticated manager would be fetched first to build the hierarchy. Otherwise, if you specify the managerId to query on then you have to specify the loginCustomerId as well. You could read through the comments in the code to better understand how the code works.

Thanks and regards,
Xiaoming, Google Ads API Team
 

Xiaoming Google Ads API Team

ref:_00D1U1174p._5004Q2CPk7n:ref

[Lewis C]

Hi Xiaoming,

I'm having the same issue as Austin. Your response doesn't explain why the error would occur.

The code pulls account IDs that the user has access to e.g.

client.service.customer.list_accessible_customers().resource_names

It then trys to pull information about each account to build the hierarchy. Why would it say "grpc_message":"The caller does not have permission","grpc_status":7" if it's only accessing information about an account the API has said you have access to?

Regards,

Lewis

[Google Ads API Forum Advisor Prod]

Hi Lewis,

Thank you for reaching out. It’s very likely you didn’t set the 'login-customer-id' in the configuration file. Please do so and try it again.

Thanks and regards,
Xiaoming, Google Ads API Team

[Austin Becker]

Hello Xiaoming, 

I really appreciate your reply. Thank you for looking into this. I could not understand the problem after reviewing the code comments in great details. 

I see in your response to Lewis that you recommend adding the 'login-customer-id' in the configuration file. This is where my confusion is coming from. The comments in the code state that:

"
If you don't specify manager ID and login customer ID, the example will instead
print the hierarchies of all accessible customer accounts for your
authenticated Google account.
"

However, when I do not specify the manager ID and login customer ID, I get this "USER PERMISSIONS" error. 

So that's my question. Why do I still get this "USER PERMISSIONS" error when I omit the 'login-customer-id' 'manager-id' even though the code sample comments say that I may omit the 'login-customer-id' along with the 'manager-ID'? 

It seems to me, after reading the code sample comments, that I should be able to omit both and then retrieve the hierarchies of all accounts (manager accounts and sub manager accounts included) from the authenticated Google Ads account.

Would greatly appreciate your help. 

Thank you,

[Google Ads API Forum Advisor Prod]

Hi Austin,

Thank you for the reply. I work with Xiaoming and let me provide support to your concern.

So that our team can have a deeper analysis to the issue, could you provide the following details via Reply privately to author option to investigate?

• Complete API request and response logs with request ID generated on your end for omitting and not omitting the 'login-customer-id' and 'manager-id'
• email address / user account used to generate Oauth2 credentials

If you haven't enabled the logging of the API transactions for the specific client library that you are using, then please refer to the specific guide below:

• Java - https://developers.google.com/google-ads/api/docs/client-libs/java/logging
• .Net - https://developers.google.com/google-ads/api/docs/client-libs/dotnet/logging
• PHP - https://developers.google.com/google-ads/api/docs/client-libs/php/logging
• Python - https://developers.google.com/google-ads/api/docs/client-libs/python/logging
• Ruby - https://developers.google.com/google-ads/api/docs/client-libs/ruby/logging
• Perl - https://developers.google.com/google-ads/api/docs/client-libs/perl/logging

Regards,

Ernie John Blanca Tacata Google Ads API Team

ref:_00D1U1174p._5004Q2CPk7n:ref