AuthorizationError.USER_PERMISSION_DENIED for standard access account API

[san...@anymindgroup.com]

Hello,

We just encounter this issue yesterday, looks like something wrong with GoogleAds api or refresh_token permissions.

So we are working as a company with a hierachy Adwords accounts: Main account => MCC account (for different countries) => single account.

We are using both python/php googleads api for user authentication and store refresh_token/access_token to build our in-house BI tools.

Yesterday, we found any user with standard access to MCC account after authentication (2 step verifcation completed), having an refresh_token that not working. 

Even when we try to generate refresh_token using Adwords OAuth2 Playground, the issue still the same.

It is throwing this exception when we try to get list customer from account:

googleads.errors.GoogleAdsServerFault: [AuthorizationError.USER_PERMISSION_DENIED @ ; trigger:'<null>']

We use the same code as the example getting hierrachy account here: https://developers.google.com/adwords/api/docs/samples/python/account-management

Another note, this is working fine for users having access to top account (the account that has access to all MCC account).

Can you please check, or let me know if other details needed.

Thanks,
Sang

[Teja Makani]

Hello Sang,

The USER_PERMISSION_DENIED error occurs when there is no link between the manager account authenticated in the request and the client account specified in the headers. Please make sure that the user authenticating the call having access to the account targeted in the API call. If the problem persists, please share the share the user's email address authenticating the call and the complete SOAP logs(request and response) without redacting any information. You could refer this README.md file to enable logging. You could use reply privately to the author option while sharing the details requested.

Regards,
Sai Teja, AdWords API Team.

[san...@anymindgroup.com]

Hi Teja,

Thank you for the reply. 

We have realized the issue is related when we init the Adwords Client.

So until now when init Adwords Client, we always use the Top Account Client ID ('108-612-4630'), for those whose only have access to MCC under this account, it's throwing the above exception.

# python googleads
adwords_client = adwords.AdWordsClient(

        ADWORDS_DEVELOPER_TOKEN, oauth2_client, ADWORDS_USER_AGENT,

        client_customer_id='108-612-4630',

        cache=common.ZeepServiceProxy.NO_CACHE

    )

But it is working fine before, so I just wonder is this a new change in Adwords API ? and because this actually requires alot of changes for us to figure out which user have access to which account to init client. 

Thanks,

Sang

[Teja Makani]

Hello Sang,

To investigate further could you please share the SOAP logs(request and response) and the email address of the user authorizing the API call as requested earlier. You could use reply privately to the author option while sharing the details requested.

Regards,
Sai Teja, AdWords API Team.

On Tuesday, November 20, 2018 at 6:20:08 AM UTC-5, san...@anymindgroup.com wrote:

[suny...@spatially.com]

Hi Teja,

Our application is going through the same error at the moment.

Are there any updates about this issue you could share with us?

Or should I open another thread to share my logs with you guys?

Thanks

[Teja Makani]

Hello Sunyoung,

Could you please share the SOAP logs(request and response) and the email address of the user authorizing the API call as requested earlier. You could use reply privately to the author option while sharing the details requested.

Regards,
Sai Teja, AdWords API Team.

On Tuesday, November 20, 2018 at 6:20:08 AM UTC-5, san...@anymindgroup.com wrote: