Accessible customers for MCC account are coming back incorrectly in Google Ads API

[Phil]

I was testing calls after adding the login_customer_id header and continually hitting an error indicating that the user did not have access to the sub account using the google ads api (python client library v0.7).  Upon further investigation, using the customer_service, I was able to make a call to 'list_accessible_customers' only to find that only the MCC account's resource name comes back in the response.  This seems to indicate that the MCC accounts are not being treated as MCCs in the new API since they should be returning all child account customer IDs as well.

I believe this is the cause of the issue being expressed in:

https://groups.google.com/forum/#!searchin/adwords-api/login$20customer$20id%7Csort:date/adwords-api/w7xLbo-Pn5E/SH5uY0xhGgAJ

as well as a few other posts.

This can be easily verified by invoking the customer_service.list_accessible_customers on an MCC account using its credentials. If you require the specific MCC account ID let me know.

[googleadsapi...@google.com]

Hi Phil,

You can retrieve the list of accounts that are directly accessible via your OAuth credentials by issuing a CustomerService.ListAccessibleCustomers request. The login-customer-id is not required for this request type, and has no effect on the list of customers returned. Could you provide your complete code and logs if you encounter any error after retying your request again?

Thanks and regards,

Luis

Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

--
--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
 
You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwor...@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups "AdWords API and Google Ads API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to adwords-api+unsubscribe@googlegroups.com.
Visit this group at https://groups.google.com/group/adwords-api.
To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/4074b3fe-df11-4b4f-89a0-9d65c318423e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Phil]

Hi Luis, I believe there is a miscommunication here.  I am not providing the login-customer-id when using list_accessible_customers, I am merely using that service to diagnose what customers are accessible given my MCC credentials.  To re-iterate my issue, I am saying that for an MCC account which has managerial authorization over several sub-accounts, list_accessible_customers only returns the customer id of the MCC account itself and not those of the sub-accounts.  Thanks.

[googleadsapi...@google.com]

Hi Phil,

The CustomerService.ListAccessibleCustomers does not return the sub accounts under your MCC but rather the list of accounts that are directly accessible via your OAuth credentials.

Hope this clears your concern.

Regards,

Luis

Google Ads API

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

--

--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
 
You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwor...@googlegroups.com
To unsubscribe from this group, send email to
adwords-api+unsubscribe@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups "AdWords API and Google Ads API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to adwords-api+unsubscribe@googlegroups.com.
Visit this group at https://groups.google.com/group/adwords-api.

To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/219dcc4f-6b1a-4d7a-8623-9cd821dd5a91%40googlegroups.com.

[Phil]

Hi Luis, thanks again for the reply.  I understand that technically the service will return customers available to the OAuth credentials, however the OAuth credentials I'm using are those of the MCC account, which has access to several sub-accounts.  In the AdWords editor, when logging into the MCC account I can access any of the sub-accounts, however when using the API under the MCC account's OAuth credentials I can only access the MCC account itself.  It's this discrepancy in access that is most confusing to me.  The OAuth credentials used to provide access to all the available sub-accounts, when invoking the AdWords customer service, however in the new Google Ads API, it does not.  Are you able to try an example case on your end in order to reproduce my findings?  Thanks.

[googleadsapi...@google.com]

Hi Phil,

My apologies for the confusion. However, the main purpose of the CustomerService.ListAccessibleCustomers is to retrieve only the list of accounts that are directly accessible by your OAuth credentials. This being said, even if your OAuth credentials have directly access to your MCC, this service will not include the sub-accounts under your MCC unless your OAuth credentials has direct access to your sub-accounts as well.

If you want to get the accounts under your manager account, you may use  customer_client resource instead. Below query should work to get the said accounts.

SELECT customer.id, customer.descriptive_name, customer_client.resource_name, customer_client.client_customer, customer_client.level, customer_client.hidden FROM customer_client

Regards,

Luis

Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

Was your question answered? Please rate your experience with us by taking a short survey.
If not -- reply to this email and tell us what else we can do to help.

Take Survey

Also find us on our blog and discussion group:
http://googleadsdeveloper.blogspot.com/search/label/adwords_api
https://developers.google.com/adwords/api/community/

To view this discussion on the web visit https://groups.google.com/d/msgid/adwords-api/2a6c15a4-e42c-4911-b4c9-d6aa2e01acbb%40googlegroups.com.

[Phil]

Ok, this is really helpful, thanks.  Since that explains that issue, I am going to loop back now to my original issue which is that for some reason, I cannot access my MCC sub-accounts using the MCC's refresh token.  This used to work fine prior to the addition of the requirement of the login_customer_id header, however it no longer works.  I do pass the login_customer_id in with the sub-account's customer ID when building the python client instance, but I'm met with an error 403 whenever I try to perform any operations.  I'm going to try to get some detailed log information and post it here.

[Phil]

Ok, so back to the original issue, unfortunately logging is not telling me much.  Here's as much info as I can provide.

The response is:

PermissionDenied: 403 The caller does not have permission

The query is pretty basic:

SELECT
                campaign.ad_serving_optimization_status,
campaign.advertising_channel_sub_type,
campaign.advertising_channel_type,
campaign.bidding_strategy,
campaign.bidding_strategy_type,
campaign.campaign_budget,
campaign.dynamic_search_ads_setting.domain_name,
campaign.dynamic_search_ads_setting.feed_ids,
campaign.dynamic_search_ads_setting.language_code,
campaign.dynamic_search_ads_setting.use_supplied_urls_only,
campaign.end_date,
campaign.start_date,
campaign.final_url_suffix,
campaign.frequency_caps,
campaign.hotel_setting.hotel_center_id,
campaign.id,
campaign.manual_cpc.enhanced_cpc_enabled,
campaign.manual_cpm,
campaign.manual_cpv,
campaign.maximize_conversion_value.target_roas,
campaign.maximize_conversions,
campaign.name,
campaign.network_settings.target_content_network,
campaign.network_settings.target_google_search,
campaign.network_settings.target_partner_search_network,
campaign.network_settings.target_search_network,
campaign.percent_cpc.cpc_bid_ceiling_micros,
campaign.percent_cpc.enhanced_cpc_enabled,
campaign.real_time_bidding_setting.opt_in,
campaign.resource_name,
campaign.serving_status,
campaign.shopping_setting.campaign_priority,
campaign.shopping_setting.enable_local,
campaign.shopping_setting.merchant_id,
campaign.shopping_setting.sales_country,
campaign.start_date,
campaign.status,
campaign.target_cpa.cpc_bid_ceiling_micros,
campaign.target_cpa.cpc_bid_floor_micros,
campaign.target_cpa.target_cpa_micros,
campaign.target_roas.cpc_bid_ceiling_micros,
campaign.target_roas.cpc_bid_floor_micros,
campaign.target_roas.target_roas,
campaign.target_spend.cpc_bid_ceiling_micros,
campaign.target_spend.target_spend_micros,
campaign.tracking_url_template,
campaign.url_custom_parameters
            FROM campaign
            WHERE
               
                campaign.advertising_channel_type IN (SEARCH, DISPLAY, SHOPPING)

The account associated with the refresh token is customer id: 691-548-5108

This is how I'm constructing the google ads client library.

return GoogleAdsClient(
    Credentials(
        None,
        refresh_token=u'1/-np1B********************************',
        client_id=u'78**********.apps.googleusercontent.com',
        client_secret=u'Iy*********************,
        token_uri=u'https://accounts.google.com/o/oauth2/token'
    ),
    u'bQ******************',
    login_customer_id=u'6736659884',
)

This used to work until just recently upon the requirement to add login_customer_id

[googleadsapi...@google.com]

Hi Phil,

Thank you for providing detailed information on this issue. To further investigate your issue here I will check this with the and will provide you an update as soon as available.

Regards,

Luis

Google Ads API Team

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[googleadsapi...@google.com]

Hi Phil,

Since this thread has a bit of confusion going on, let me try to clarify.

Google Ads allows you to associate a login email to multiple accounts. Most users have only one account per login email. Some users have more than one. If your login email is added to multiple accounts, you will be presented with an account picker upon login. This picker lets you select an account, and the rest of your session will use that account as context. If your login email has been added to only one account, then this dialog won't show up.

ListAccessibleCustomers replicates the functionality of the account picker. Login Customer ID is the account you pick from the dialog.

Since your login email is only associated with one account, ListAccessibleCustomers will return only one account (691-548-5108). You should use login-customer-id as 6915485108 for the rest of your API calls.

CustomerId is the actual account you work against. Since you are retrieving campaigns from 6736659884, you should set the customerId to 6736659884.

The call fails right now because you are incorrectly setting 6736659884 as login-customer-id (it fails because the refresh token doesn't belong to 6736659884).

Hope this helps? Let me know if you have more questions.

Cheers

Anash P. Oommen,

Google Ads API Team.

=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog and discussion group:
    http://googleadsdeveloper.blogspot.com/search/label/adwords_api
    https://developers.google.com/adwords/api/community/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~

[Phil]

Beautiful!  That was exactly my issue.  So to summarize the problem and solution, we are adding login_customer_id of the customer id of the refresh token holder, as opposed to the customer id of the sub-account we want to access.  I was incorrectly adding the sub-account's customer id.  My issue is resolved now.  Thank you both (yourself and Luis) for all the assistance on this one!