permission problem for creating userlist

[eureca]

Hi,
 I've successfully linked the advertiser account to our app, but once we want to create a userlist, we have the following error :

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><ns2:ResponseHeader xmlns:ns2="https://adwords.google.com/api/adwords/rm/v201802" xmlns="https://adwords.google.com/api/adwords/cm/v201802"><requestId>00056fbf536283380a8157011f00c3bd</requestId><serviceName>AdwordsUserListService</serviceName><methodName>mutate</methodName><operations>1</operations><responseTime>184</responseTime></ns2:ResponseHeader></soap:Header><soap:Body><soap:Fault><faultcode>soap:Client</faultcode><faultstring>[OperationAccessDenied.ACTION_NOT_PERMITTED
 @ class
com.google.ads.boulder.api.services.datax.userlists.AdwordsMutateAction]</faultstring><detail><ns2:ApiExceptionFault
 xmlns="https://adwords.google.com/api/adwords/cm/v201802" xmlns:ns2="https://adwords.google.com/api/adwords/rm/v201802"><message>[OperationAccessDenied.ACTION_NOT_PERMITTED
 @ class
com.google.ads.boulder.api.services.datax.userlists.AdwordsMutateAction]</message><ApplicationException.Type>ApiException</ApplicationException.Type><errors
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 
xsi:type="OperationAccessDenied"><fieldPath></fieldPath><trigger></trigger><errorString>OperationAccessDenied.ACTION_NOT_PERMITTED</errorString><ApiError.Type>OperationAccessDenied</ApiError.Type><reason>ACTION_NOT_PERMITTED</reason></errors></ns2:ApiExceptionFault></detail></soap:Fault></soap:Body></soap:Envelope>
 

Do you have enough information with the provided requestId ?

Do you have an explanation / path of actions we need to take to avoid the error ?

Best,
Mathieu

[Teja Makani]

Hello Eureca,

Thanks for sharing the logs, OperationAccessDenied.ACTION_NOT_PERMITTED error is encountered when you don't have the authorization to invoke the mutate method. It is possible that you're using the credentials with read-only access to create the user list. You will need to have either a standard or administrative access level to make changes to the advertiser's account. You could refer to the steps shown under "How to edit access level" section of this guide to edit the access level.

If you continue to have an issue with this, could you provide us the email address associated to the refresh token via Reply privately to author option, so we can take a look?

Regards,

Sai Teja, AdWords API Team.

[eureca]

Hi Sai,
 thanks for the information & process.

 In our process when the user does the oauth to authorize our app, we then request the list of advertiser accounts linked to the MCC account (flag canManageClients at true).

 Is it possible to know if the current account is in read-only mode ? Thus we won't authorize to go further.
 Is it possible through the API to switch to read-write mode if the account is read-only ?

 Thanks.

Mathieu

[Teja Makani]

Hello Eureca,

The canManageClients flag represents whether this customer can manage other AdWords customers or not. If it is true the account is a manager account else it is a regular AdWords account. Currently, there is no way to fetch or update the access level via API. However, you can check your access level by navigating to your AdWords account then selecting Account settings -> Account access. You need to follow the steps mentioned in the above response to change the access level via UI. Please let me know if you have any further questions. 

[eureca]

Thanks Teja !

We'll update documentation on our end.

Best,

Mathieu