Link manager , USER_PERMISSION_DENIED

[林灿]

Hi：

        I'm using the java API to bind a customer_id from another manager account to my test account manager。

        I get the error, "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid"。
         I've specified the login_customer_id in the code.
request_id: "tT3HCScr6nX4zbutQ04wbQ"，customer_id: "2154272009"，managerId:"7306826639"

Refer to the code example：Google Ads API

[Google Ads API Forum Advisor]

Hello,

Welcome to Google Ads API support team. Thank you for reaching out to us.

With regards to your concern, I can see that you’ve encountered the authorization_error: USER_PERMISSION_DENIED. It means the authorized customer does not have access to the operating customer. The common cause of this error is when authenticating as a user with access to a manager account but not specifying login-customer-id in the request. To prevent this kind of error, you need to make sure to specify the login-customer-id as the manager account ID without hyphens (-). Client libraries have built in support for this, or see our guide, in which you mentioned you already did. Having said that, it's possible that the user associated with the OAuth credentials (client ID and secret) does not have access to the manager account. With this, would you be able to provide us with the email used to create those credentials so we can check their permissions.

Regards,

Google Ads API Team

ref:_00D1U1174p._5004Q2jXERh:ref

[Google Ads API Forum Advisor]

Hi, 

Thank you for returning to our team.

Confirming that we have received your response. Kindly note that I had to delete your recent post in the forum as it contains your email address.

Upon checking, it appears that your provided email address doesn't have access to the specified account (215-427-2009) in your request and this is the reason why you are experiencing this error on your end. That said, please make sure that the user / email address that generated the OAuth2 credentials you are using should have access to the account specified in your request. You can manage user access by referring to this article.

[林灿]

Hello,

         I don't understand, can you give me a specific steps and example.
        My requirement is to operate the advertiser account of another manager account under one manager account. What I understand now is that I need to link this account to my manager account, so I called this interface, but now I have a permission problem. According to what you said, do I need to modify the permissions before calling this interface? 

Or can you provide other solutions and java code samples

[Google Ads API Forum Advisor]

Hi,

Thank you for the reply.

I could confirm that the provided email address lia****@gmail.com doesn't have access to the specified account (215-427-2009) in your request and this is the reason why you are experiencing this error on your end. You can also check the access levels on your account’s TOOLS AND SETTINGS > Access and Security > Users.

On the other hand, you may check this documentation for managing user access. You can also review who has access to your account, edit their access levels, and remove user accounts to learn more about account access levels and learn how to grant or revoke access to your Google Ads account.

Additionally, you may check and refer to this java sample code for updating user access.

Best regards,

[林灿]

Hello,

          I tried the above interface many times and the same error occurred when modifying permissions“（userAccessServiceClient.mutateCustomerUserAccess(String.valueOf(customerId), operation)）”. 

Not sure if it's my parameter passing problem, can you give guidance? For example: manager account M1, emailAddress1, customer1, manager account M2, mailbox email2, customer2, the customer2 account needs to be bound to the manager account M1, how should the interface parameters "customerId, emailAddress" be passed, and which manager account is used by googleAdsClient create."private void runExample(

GoogleAdsClient googleAdsClient,long customerId,String emailAddress,AccessRole accessRole) {}"

Best regards,

[Google Ads API Forum Advisor]

Hi,

Thanks for getting back to us.

As we have mentioned previously in our email, the provided email address lia****@gmail.com doesn't have access to the specified account (215-427-2009). The error USER_PERMISSION_DENIED means the user doesn't have permission to access the customer. That said, can you try adding this email address as a user in the account? You can access this through navigating TOOLS AND SETTINGS > Access and Security > Users in the said account.

Let me know how it goes. If the error persists after trying the suggested solution, you may share to us the complete request and response logs with the request-id so we can check further. For the Java client library, logging can be enabled by following this guide. Kindly note that it would help us investigate the cause of your error if we have these logs.

Regards,

[林灿]

Hello,

         I hope to achieve this function through the Google ads api, rather than "through navigating TOOLS AND SETTINGS > Access and Security > Users."

 I will need to manage more sub-accounts under different manager accounts in the future. My current solution is to pull the sub-account under the user after the user authorizes on the OAuth2.0 page, and then bind it to my manager account, but now I have been encountering permission problems. Or can you provide me another solution?

[Google Ads API Forum Advisor]

Hi,

Thank you for getting back to us. I hope you are doing well today.

Moving forward to your concern, you may refer to this document. This document contains information on invite users through Google Ads API. As per document said, you can send an email invitation to a new user as part of managing access to a Google Ads account. This is done by creating a new CustomerUserAccessInvitation using the MutateCustomerUserAccessInvitationmethod of the CustomerUserAccessInvitationService. Please note that the email invitation needs to be manually accepted by the user who received the invitation. The invitation can also be accepted by the user using an alternate email address.

I hope this helps.

Let us know if you have further questions.

[林灿]

Hello,

          Do emails have to be processed manually? I don't want this way, the user has been authorized by Oauth2.0, in this case, how should the sub-account under the user be linked to my managerId

[Google Ads API Forum Advisor]

Hi,

Thank you for returning back to our team.

Regarding your issue, as mentioned, the reason why you are getting the USER_PERMISSION_DENIED is because the provided user/email address does not have access to the account (215-427-2009). You may see the below options in order to add or grant access to your provided user/email address:

• Managing User Access (Through the Google Ads API)
• Manage access to your Google Ads account (Manually or through the Google Ads UI)

As for "how should the sub-account under the user be linked to my managerId", are you referring to linking the sub/client account to the manager account? If yes, then you may see the options depending on what is your preferred way of doing this:

• Linking to Manager Accounts (Through the Google Ads API)
• Link accounts to your manager accounts (Manually or through the Google Ads UI)

I hope this helps.