Using API to determine User Access Level

[Clicquot The Dog]

As per the documentation here, there are several types of User Access levels (Admin, Standard, MCC, etc). I have an application that allows users to add campaigns, and for one particular user, I'm getting an OperationNotPermitted error on the AdGroupAd service. I have a sneaking suspicion that the user in client authenticated with an account that only has "Read-only" access. Is there an API I could use to see what access level a particular person (via a customerId, etc) has?

[Anthony Madrigal]

Hello,

There is currently no way to see your access level by using the API. However, you can check your access level by navigating to your AdWords account then selecting Account settings -> Account access.

Cheers,

Anthony

AdWords API Team

[Clicquot The Dog]

Thanks for the reply Anthony. Assuming though that I can't exactly walk over to said user's computer to see what kind of Account access they have, is there a suggested approach to dealing with this? I dislike the idea of essentially doing a try / catch when creating an ad because I don't know ahead of time whether the client has permission to do so.

[Anthony Madrigal]

Hello,

Unfortunately, there is no way to check using the API. However, you do not need to be on the user's computer or be logged in to see their access level. While on the Account access page, you can see the access levels of you and other users. I have attached a screenshot to show you.

[Zweitze]

Consider making a test call at the start, with SOAP Header "ValidateOnly" set to true. Suitable test calls are creating an ad group (easiest) or creating a campaign (harder, but also works on accounts without campaigns).

Hope this helps.

Note: I think security is not a point of focus at Google. I asked at an API workshop what happens whether a user with read only access can execute a script, and in that case whether the script could set labels. The silence said it all. Noone knew the expected behavior (eg. are errors logged or is the log readonly?!) could be. This was over a year ago but I don't think anything changed.