PermissionDenied, even when setting LoginCustomerId

[francis....@gmail.com]

Hi there, 

I'm getting this error when calling GoogleAdsService.SearchAsync with Net SDK v10:

Status(StatusCode="PermissionDenied", Detail="The caller does not have permission", DebugException="Grpc.Core.Internal.CoreErrorDetailException: {"created":"@1648740607.037000000","description":"Error received from peer ipv4:172.217.13.202:443","file":"..\..\..\src\core\lib\surface\call.cc","file_line":1070,"grpc_message":"The caller does not have permission","grpc_status":7}")

It works for most customers, but some requests fail with this error. I'm already setting the LoginCustomerId. What else should I look for?

I can provide the logs privately if needed.

Thank you,

Francis

[Google Ads API Forum Advisor]

Hi Francis,

Thank you for reaching out to us.

As per this guide , if your access to the customer account is through a manager account, this header is required and must be set to the customer ID of the manager account.

To elaborate, if your OAuth2 credentials were generated using a user / email address associated to your manager account, you will need to specify that manager account's ID as the login-customer-id. Let me know how this goes on your end.

Best regards,

Heidi Google Ads API Team

ref:_00D1U1174p._5004Q2ZIVvS:ref

[francis....@gmail.com]

Hi Heidi,

yes, I'm setting the login-customer-id header with the manager account's id. I do it through the .Net SDK with the property LoginCustomerId of the GoogleAdsConfig class.

As I said, it works for most accounts, but sometimes I get the error. What else should I be looking for? Do you need the logs?

Thank you Francis

[Google Ads API Forum Advisor]

Hi Francis,

Thank you for the reply. I am also a member of the Google Ads API team and let me provide support to your concern.

To further investigate the error, could you provide complete request and response logs with request ID and request header generated on your end? Please provide the information in the format that you can see in provided links. Also, it will be helpful if you can provide the email address / user account that you've used in the authentication.

If you haven't enabled the logging of the API transactions for the specific client library that you are using, then please refer to this specific guide.

You can provide it via Reply privately to author option. If this option is not available, then send it instead on this email address googleadsa...@google.com.

Regards,

Ernie John Google Ads API Team

ref:_00D1U1174p._5004Q2ZIVvS:ref

[francis....@gmail.com]

Hi Ernie,

I was wondering if you got my private response with the logs you requested?

Francis

[David Lopes]

Hello,

We've been experiencing this issue with 2 new accounts that we are trying to access.
The error is exactly the same as the original question and I was wondering how did you manage to solve this issue.

Thanks for your help,

D.

[Google Ads API Forum Advisor]

Hi,

Thank you for reaching out to our team.

Please note that the USER_PERMISSION_DENIED error occurs when the authorized customer does not have access to the operating customer. You mentioned that you already tried setting the 'login-customer-id' equal to the manager customer id but unfortunately, it still throws the said error. It also occurs when the OAuth2 credentials you are using were generated by a user / email address that does not have access to the account (customer_id) specified in your request. You can manage user access by referring to this article.

If the issue persists even after doing the above details, you may send us the complete request and response logs with request ID and request header generated on your end and the user / email address that you used in your authentication process for further investigation.

You may then send the requested logs via the Reply privately to author option. If this option is not available, you may send the details directly to our googleadsa...@google.com alias instead.

Regards,

Google Ads API Team

ref:_00D1U1174p._5004Q2ZIVvS:ref

[David Lopes]

Hello,

I was wondering if you got my private response with the requested logs?

Thanks,

D.

[Google Ads API Forum Advisor]

Hi David,

It appears that your message didn't went through via Reply privately to author option. Could you kindly share the information via googleadsa...@google.com alias instead? Kindly include the link of this forum thread, so we could trace it back where it came from.