OperationAccessDenied.ACTION_NOT_PERMITTED on CustomerService.Get()

[Zweitze]

Hi all,

Since a week or so I get OperationAccessDenied.ACTION_NOT_PERMITTED when calling CustomerService.Get(). This happens on a few customers.

Why is that?

Sample RequestId 0004f2c0d37ef0c80ade62c6000002ab
Many more are available.


Thanks in advance!

[Takeshi Hagikura (AdWords API Team)]

Hi Zweltze,

Thanks for the report. 

There was an issue that caused OperationAccessDenied.ACTION_NOT_PERMITTED.

The issue that caused the OperationAccessDenied.ACTION_NOT_PERMITTED has been fixed. 

Can you please try the same request?

Best,

- Takeshi, AdWords API Team

[Zweitze]

Takeshi,

The problem is not solved.

0004f2e91b0162a00ade6f8500001bf0

0004f2e914916bb80ade47070000657c
The calls were made 3+ hours after your post.

Thanks in advance!

[Takeshi Hagikura (AdWords API Team)]

Hi Zweltze, 

Ok, I'll look into it. 

Are these requestIds right?

0004f2e91b0162a00ade6f8500001bf0

0004f2e914916bb80ade47070000657c

I couldn't find the logs for those requestIds. 

Is it possible to share your request and response XML logs (other than sensitive info)?

If you are reluctant to share it here, you can send me privately from the "Reply to the author" from the top right corner.

Best,

- Takeshi, AdWords API Team

[Zweitze]

Takeshi,

The production server has no SOAP logs, this is from a development machine. The error is the same.

-----------------BEGIN API CALL---------------------

Request
-------


<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><!--POST /api/adwords/mcm/v201309/CustomerService
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.4247)
VsDebuggerCausalityData: uIDPo9cWft9bg6tGr1kOxu6Be3AAAAAAK8VYx9gIBE+vUme4lYh0P4X3HGS7wyJEuuG91ZtjG8MACQAA
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Host: adwords.google.com
Content-Length: 1003
Accept-Encoding: gzip
TimeStamp: Mon, 24 Feb 2014 11:04:46 GMT
--><soap:Header><RequestHeader xmlns="https://adwords.google.com/api/adwords/mcm/v201309"><authToken xmlns="https://adwords.google.com/api/adwords/cm/v201309">******</authToken><developerToken xmlns="https://adwords.google.com/api/adwords/cm/v201309">******</developerToken><userAgent xmlns="https://adwords.google.com/api/adwords/cm/v201309">Adwords API by Maxlead (AwApi-DotNet/16.5.1, Common-Dotnet/2.0.1, .NET CLR/2.0.50727.4247, gzip)</userAgent></RequestHeader></soap:Header><soap:Body><get xmlns="https://adwords.google.com/api/adwords/mcm/v201309" /></soap:Body></soap:Envelope>

Response
--------


<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><!--Content-Encoding:
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 550
Cache-Control: private, max-age=0
Content-Type: text/xml; charset=UTF-8
Date: Mon, 24 Feb 2014 10:05:08 GMT
Expires: Mon, 24 Feb 2014 10:05:08 GMT
Server: GSE
TimeStamp: Mon, 24 Feb 2014 11:04:46 GMT
--><soap:Header><ResponseHeader xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201309" xmlns="https://adwords.google.com/api/adwords/mcm/v201309"><ns2:requestId>0004f3241b3ebbd80ade6f8500004a13</ns2:requestId><ns2:serviceName>CustomerService</ns2:serviceName><ns2:methodName>get</ns2:methodName><ns2:operations>0</ns2:operations><ns2:responseTime>265</ns2:responseTime></ResponseHeader></soap:Header><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>[OperationAccessDenied.ACTION_NOT_PERMITTED @ class com.google.ads.boulder.api.services.customer.GetAction]</faultstring><detail><ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/mcm/v201309" xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201309"><ns2:message>[OperationAccessDenied.ACTION_NOT_PERMITTED @ class com.google.ads.boulder.api.services.customer.GetAction]</ns2:message><ns2:ApplicationException.Type>ApiException</ns2:ApplicationException.Type><ns2:errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ns2:OperationAccessDenied"><ns2:fieldPath></ns2:fieldPath><ns2:trigger></ns2:trigger><ns2:errorString>OperationAccessDenied.ACTION_NOT_PERMITTED</ns2:errorString><ns2:ApiError.Type>OperationAccessDenied</ns2:ApiError.Type><ns2:reason>ACTION_NOT_PERMITTED</ns2:reason></ns2:errors></ApiExceptionFault></detail></soap:Fault></soap:Body></soap:Envelope>
-----------------END API CALL-----------------------

Thanks in advance!

[Takeshi Hagikura (AdWords API Team)]

Hi Zwelte, 

Thanks for the input. 

Let me confirm, looks like the request doesn't include clientCustomerId header. Is it expected? (Are you using the credential from the AdWords client account?)

Also can you please let me know from what account you got the auth token? (I'd like to make sure if it has only the read-only permission. The issue we saw a week ago was about that case)

Best,

- Takeshi, AdWords API Team

[Zweitze]

Takeshi,

Indeed there is no CustomerId in the header. Our workflow is like this:
1. Using an AdWords login (or user), Get the authenticationtoken
2. Call CustomerService.Get() to get the CustomerId
3. Do the rest with the authenticationtoken and CustomerId

This works for most of the AdWords logins, but not that specific login. I will mail that login to you.
Indeed this could be related to that other issue - I thought the login had administrative access, apparently it does not.

Regards
Zweitze

(PS I didn't notice because the forum search function is seriously broken... again. Take a look at this result page to see what I mean: at least this topic should show up. But the forum development group is really obnoxious and doesn't appreciate feedback, so I stopped bothering. Still... wouldn't it be a good idea to move this forum to a better platform?)

[Chirag]

Hello Takeshi,

I am also facing the same issue with customer service since few days, its working for most but for few clients it is giving me error faultMessage=[OperationAccessDenied.ACTION_NOT_PERMITTED @ class com.google.ads.boulder.api.services.customer.GetAction].

requestId=0004f35cdb1621200aa43c04000059cb

Also need to confirm that accesstoken was fetched from AdWords account and login has proper permission. I am able to get other services working properly.

I have also same flow, 1. Client authenticate using Oauth2.0 get the refresh token

2. Call CustomerService.Get() to get the CustomerId

3. Do the get the campaigns using refresh token and CustomerId.

Thanks,
Chirag

[Takeshi Hagikura (AdWords API Team)]

Hi Chirag,

Thanks for the input. 

I checked it with the relevant engineer. 

The fix will be applied anytime soon. 

Best,

- Takeshi, AdWords API Team

[Chirag]

Hello Takeshi,

Thanks for update.

[Rob]

Hi Takeshi,

If it helps, I've found this is only failing intermittently. The following request gave two different responses at various times.

<?xml version="1.0" encoding="UTF-8"?>

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="https://adwords.google.com/api/adwords/mcm/v201309" xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201309"><SOAP-ENV:Header><ns1:RequestHeader><ns2:authToken>REDACTED</ns2:authToken><ns2:clientCustomerId>9088114776</ns2:clientCustomerId><ns2:developerToken>REDACTED</ns2:developerToken><ns2:userAgent>ICC NTL</ns2:userAgent></ns1:RequestHeader></SOAP-ENV:Header><SOAP-ENV:Body><ns1:get/></SOAP-ENV:Body></SOAP-ENV:Envelope>

Working response:

HTTP/1.1 200 OK

Date: Thu, 27 Feb 2014 16:34:09 GMT

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><ResponseHeader xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201309" xmlns="https://adwords.google.com/api/adwords/mcm/v201309"><ns2:requestId>0004f365e3f81f100adb052a00007561</ns2:requestId><ns2:serviceName>CustomerService</ns2:serviceName><ns2:methodName>get</ns2:methodName><ns2:operations>0</ns2:operations><ns2:responseTime>252</ns2:responseTime></ResponseHeader></soap:Header><soap:Body><getResponse xmlns="https://adwords.google.com/api/adwords/mcm/v201309" xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201309"><rval><customerId>9088114776</customerId><currencyCode>GBP</currencyCode><dateTimeZone>Europe/London</dateTimeZone><descriptiveName>Aerial Force</descriptiveName><canManageClients>false</canManageClients><testAccount>false</testAccount></rval></getResponse></soap:Body></soap:Envelope>

Failed response:

HTTP/1.1 500 Internal Server Error

Date: Thu, 27 Feb 2014 16:34:12 GMT

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><ResponseHeader xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201309" xmlns="https://adwords.google.com/api/adwords/mcm/v201309"><ns2:requestId>0004f365e42f67680adb084400006369</ns2:requestId><ns2:serviceName>CustomerService</ns2:serviceName><ns2:methodName>get</ns2:methodName><ns2:operations>0</ns2:operations><ns2:responseTime>169</ns2:responseTime></ResponseHeader></soap:Header><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>[OperationAccessDenied.ACTION_NOT_PERMITTED @ class com.google.ads.boulder.api.services.customer.GetAction]</faultstring><detail><ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/mcm/v201309" xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201309"><ns2:message>[OperationAccessDenied.ACTION_NOT_PERMITTED @ class com.google.ads.boulder.api.services.customer.GetAction]</ns2:message><ns2:ApplicationException.Type>ApiException</ns2:ApplicationException.Type><ns2:errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ns2:OperationAccessDenied"><ns2:fieldPath></ns2:fieldPath><ns2:trigger></ns2:trigger><ns2:errorString>OperationAccessDenied.ACTION_NOT_PERMITTED</ns2:errorString><ns2:ApiError.Type>OperationAccessDenied</ns2:ApiError.Type><ns2:reason>ACTION_NOT_PERMITTED</ns2:reason></ns2:errors></ApiExceptionFault></detail></soap:Fault></soap:Body></soap:Envelope>

[Ray Tsang (AdWords API Team)]

Rob,

This issue has been reported.  Thanks for letting us know!

Ray

[Jofin Kuriakose]

Hi Adwords API Team,

I'm facing this issue once again, here is my soap response and its failing intermittently, if you need further detail would like to share. In our case, we use adwords user login to obtain the customer id and other details like timezone, currency etc.

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><ResponseHeader xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201710" xmlns="https://adwords.google.com/api/adwords/mcm/v201710"><ns2:requestId>00056dcf9f121ec10abcd9cfd000719a</ns2:requestId><ns2:serviceName>CustomerService</ns2:serviceName><ns2:methodName>getCustomers</ns2:methodName><ns2:operations>0</ns2:operations><ns2:responseTime>200</ns2:responseTime></ResponseHeader></soap:Header><soap:Body><soap:Fault><faultcode>soap:Server</faultcode><faultstring>[OperationAccessDenied.ACTION_NOT_PERMITTED @ ; trigger:\'&lt;null&gt;\']</faultstring><detail><ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/mcm/v201710" xmlns:ns2="https://adwords.google.com/api/adwords/cm/v201710"><ns2:message>[OperationAccessDenied.ACTION_NOT_PERMITTED @ ; trigger:\'&lt;null&gt;\']</ns2:message><ns2:ApplicationException.Type>ApiException</ns2:ApplicationException.Type><ns2:errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ns2:OperationAccessDenied"><ns2:fieldPath></ns2:fieldPath><ns2:trigger>&lt;null&gt;</ns2:trigger><ns2:errorString>OperationAccessDenied.ACTION_NOT_PERMITTED</ns2:errorString><ns2:ApiError.Type>OperationAccessDenied</ns2:ApiError.Type><ns2:reason>ACTION_NOT_PERMITTED</ns2:reason></ns2:errors></ApiExceptionFault></detail></soap:Fault></soap:Body></soap:Envelope>

[Sreelakshmi Sasidharan (AdWords API Team)]

Hello Jofin, 

Regret the delay in responding. Are you still facing ACTION_NOT_PERMITTED? We had an issue a while ago which is currently fixed. If you continue to face issues. Please use reply privately to author option and share you SOAP logs (request and response) along with the email id of the user authenticating the API call. I can take a closer look. 

Thanks,
Sreelakshmi, AdWords API Team