Is there a delay on linking account process and propagate permissions?

[Minaya Serrano]

Hi, we have automated a process with which we link an account to an MCC and create a Google Ads Transfer with the BigQuery Data Transfer Service automatically.

So far, with BigQuery Data Transfer Service for Adwords the process was working smoothly, but with the new BigQuery Data Transfer Service for Google Ads we are experiencing permissions errors.

It seems that the account is linked correctly, but getting the MCC accounts it is not retrieving the new account. Several minutes after, the same query on the API retrieves the new account.

It seems that there is a cache or a delay in the update of these permissions and the transfer jobs launched automatically give us the following error:

"The caller does not have permission Raw error response from Google Ads API: { "error": { "code": 403, "message": "The caller does not have permission", "errors": [ { "message": "The caller does not have permission", "domain": "global", "reason": "forbidden", "debugInfo": "detail: \"[ORIGINAL ERROR] generic::permission_denied: User doesn\\'t have permission to access customer. Note: If you\\'re accessing a client customer, the manager\\'s customer id must be set in the \\'login-customer-id\\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid [google.rpc.error_details_ext] { details { type_url: \\\"type.googleapis.com/google.ads.googleads.v13.errors.GoogleAdsFailure\\\" value: \\\"\\\\n\\\\377\\\\001\\\\n\\\\002H\\\\002\\\\022\\\\370\\\\001User doesn\\\\\\'t have permission to access customer. Note: If you\\\\\\'re accessing a client customer, the manager\\\\\\'s customer id must be set in the \\\\\\'login-customer-id\\\\\\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid\\\\022\\\\026ss4lSkg3tqZhNCc8LKna_g\\\" } }\"\n" } ], "status": "PERMISSION_DENIED", "details": [ { "@type": "type.googleapis.com/google.ads.googleads.v13.errors.GoogleAdsFailure", "errors": [ { "errorCode": { "authorizationError": "USER_PERMISSION_DENIED" }, "message": "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api"

If we retry the transfer manually after several minutes, the transfer works.

Is there any cache on getting accounts? Is it possible to invalidate this cache to get the updated accounts?

Regards,

[Google Ads API Forum Advisor]

Hi Minaya,

Thank you for reaching out to the Google Ads API support team. I hope that you are doing well today.

Moving forward to your concern, could you please elaborate this question "Thank you for reaching out to the Google Ads API support team. I hope that you are doing well today."? Furthermore, upon checking on the response you provided, I can see that you encountered a USER_PERMISSION_DENIED error. This error usually indicates that the authorized customer does not have access to the operating customer. That being said, you will need to ensure that the user / email address you used to generate the OAuth2 credentials indeed has access to the account in your request. If the user / email address has access or is associated with the MCC / manager account, you will need to specify the MCC / manager account's ID without hyphens (-) as the value of the login-customer-id field.

Let us know how it goes on your end if this resolves your issue. If the error persists after trying the suggested solution, then you may provide to us the complete API logs (request and response with the request-id) generated along with the email address used to generate the OAuth2 credentials from your end so we can investigate further.

You can provide it via Reply privately to the author option. If this option is not available, then send it instead on this email address googleadsa...@google.com.

Reference links included in this email:

• USER_PERMISSION_DENIED - https://developers.google.com/google-ads/api/docs/best-practices/common-errors?hl=en#authorizationerror
• OAuth2 credentials - https://developers.google.com/google-ads/api/docs/oauth/cloud-project?hl=en#create_a_client_id_and_client_secret
• access - https://support.google.com/google-ads/answer/9978556?visit_id=637628826037447236-382779227&rd=1
• login-customer-id - https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid
• request - https://developers.google.com/google-ads/api/docs/concepts/field-service?hl=en#request
• response - https://developers.google.com/google-ads/api/docs/concepts/field-service?hl=en#response
• request-id - https://developers.google.com/google-ads/api/docs/concepts/call-structure?hl=en#request-id

Kind regards,

Google Ads API Team

ref:_00D1U1174p._5004Q2lImv0:ref

[Minaya Serrano]

I'm sorry but we don't understand your answer.

We can't change oauth2 credentials. The error raises on BigQuery Data Transfer Service for Google Ads jobs. These jobs are managed by Google Cloud, not us. 

Regardless of this, with same OAuth2 credentials and BigQuery Data Transfer Service for Adwords it works like a charm. It seems that any behavior has changed with the new DTS for Google Ads.

Regards,