Error not search only on specific manager account

[박주호]

After generating oauth client id and password in gcp
I authenticated the google ads and sent a search request, but there was an error as follows.
But strangely, certain mannager accounts do not cause errors, but some mannerger accounts cause errors.
(Both removed and requested hyphens (-)
What's the problem?
The error below is a manger account that removes the hyphen (-) and transfers the error that occurred when the search request was made.

The same refresh token, oauth client id, oauth client password
If the manager account changes, an error occurs
It's a manager account under the same google account.
Both removed the hyphen (-) and asked for it
Some mannager accounts normally provide search values
Some mannager accounts cause errors.

I wrote the request id value that caused the error as an error below

Do I have to tell you the mannager account that caused the error and the mannager account that did not cause the error?

(<_SingleThreadedRendezvous of RPC that terminated with:
        status = StatusCode.PERMISSION_DENIED
        details = "The caller does not have permission"
        debug_error_string = "{"created":"@1647847100.582000000","description":"Error received from peer ipv4:216.58.220.138:443","file":"src/core/lib/surface/call.cc","file_line":1067,"grpc_message":"The caller does not have permission","grpc_status":7}"
>, <_SingleThreadedRendezvous of RPC that terminated with:
        status = StatusCode.PERMISSION_DENIED
        details = "The caller does not have permission"
        debug_error_string = "{"created":"@1647847100.582000000","description":"Error received from peer ipv4:216.58.220.138:443","file":"src/core/lib/surface/call.cc","file_line":1067,"grpc_message":"The caller does not have permission","grpc_status":7}"
>, errors {
  error_code {
    authorization_error: USER_PERMISSION_DENIED
  }
  message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid"
}
request_id: "OZ_-1GsLyYd7LZq3Th63uQ"
, 'OZ_-1GsLyYd7LZq3Th63uQ')

[Google Ads API Forum Advisor]

Hi there,

You have access to the API and some of your manager accounts work. Without any further information I can only guess that the refresh token you are using was created with a Google Account that is a user in some of your MCC accounts, but isn't a user in some of the MCC accounts. The login customer id header has to be filled with an account number directly accessible with your OAuth credentials. In other words, the refresh token is generated using a specific Google Account. That Google Account has to be a direct user in the Ads account that is referenced in the login customer Id header. 

You can retrieve the list of accounts that are directly accessible with your OAuth credentials by issuing a CustomerService.ListAccessibleCustomers request. The login-customer-id is not required for this request type, and has no effect on the list of customers returned.

If the above doesn't fully address this issue, could you privately send us the Google account that was used in generating the refresh token, a request and response log of API communication when log level is set to ‘DEBUG' which shows this error?  

The request and response appears similar to the JSON Mappings in our REST documentation. Our client libraries have loggers with logging instructions, to see these instructions you can click on the client library you use in the sidebar of our client library guide and click on "Logging". 

Regards,

Aryeh Google Ads API Team

​​​​​​​

ref:_00D1U1174p._5004Q2YpmuU:ref