Manager Account ID

[Nguyen Vien]

Hello, I am building web app allow user can login Google through OAuth2 API, then I will get all accounts of Google Ads. But sometimes I get this error 
(<_InactiveRpcError of RPC that terminated with: status = StatusCode.PERMISSION_DENIED details = "The caller does not have permission" debug_error_string = "UNKNOWN:Error received from peer ipv4:173.194.193.95:443 {created_time:"2024-08-20T19:51:11.94104574+00:00", grpc_status:7, grpc_message:"The caller does not have permission"}" >, <_InactiveRpcError of RPC that terminated with: status = StatusCode.PERMISSION_DENIED details = "The caller does not have permission" debug_error_string = "UNKNOWN:Error received from peer ipv4:173.194.193.95:443 {created_time:"2024-08-20T19:51:11.94104574+00:00", grpc_status:7, grpc_message:"The caller does not have permission"}" >, errors { error_code { authorization_error: USER_PERMISSION_DENIED } message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid" } request_id: "3sUCTMfJmir9N0FJITjCyg" , '3sUCTMfJmir9N0FJITjCyg')
I have used query is 
SELECT customer_client.id, customer_client.descriptive_name, customer_client.manager, customer_client.currency_code FROM customer_client where customer_client.manager = false. After get list manager account the user has direct access to through List Accessible Accounts return. I have used this query to get all accounts of it but I have noticed sometimes I got this error. 

[Google Ads API Forum Advisor]

Hi,

Thank you for reaching out to the Google Ads API support team.

To confirm, is the issue that you are encountering the 'USER_PERMISSION_DENIED' error while executing a query in Search and SearchStream, though you have direct access to the account in the request?

To avoid the USER_PERMISSION_DENIED error, you will need to ensure that the user / email address you used to generate the OAuth2 credentials indeed has access to the account in your request. If the user / email address has access to or is associated with the MCC / manager account, you will need to specify the MCC / manager account's ID without hyphens (-) as the value of the login-customer-id field. 

Also, to assist you further, please provide us with the "complete API logs" (request and response with request-id and request header) generated at your end while encountering this error. Additionally, send us the email address you used to generate the OAuth2 credentials.

If you are using a client library and haven't enabled the logging yet, I would request you to enable logging for the specific client library that you are using. You can refer to the guides Java, .Net, PHP, Python, Ruby or Perl to enable logging at your end. For REST interface requests, you can enable logging via the curl command by using the -i flag.

You can send the details via Reply privately to the author option, or direct private reply to this email.

 

This message is in relation to case "ref:!00D1U01174p.!5004Q02vFBpm:ref" (ADR-00264154)

Thanks,
 

Google Ads API Team

[Nguyen Vien]

Yep, I am facing 'USER_PERMISSION_DENIED' error while executing a query in Search and SearchStream with accounts which I have direct access
First, I get list customers accessible by ListAccessibleCustomers method. Then I get accounts of customers, because my account I got is root manager, so haven't manager account's ID for it
But this error only occurs occasionally. That means sometimes it succeeds and sometimes it returns this error 
My email that I used to generate the OAuth2 credentials is viennguye...@gmail.com 

[Nguyen Vien]

Have any news update about it ?

[Google Ads API Forum Advisor]

Hi,

It appears that you might have missed our previous response.

The 'USER_PERMISSION_DENIED' error occurs when the MCC account is not linked to the customer account from which the API request is being made. To resolve this, ensure that your customer account is correctly linked to the appropriate MCC account and that the developer token used in the API calls is valid. Another potential cause is that the email ID used to generate the OAuth credentials is not listed as having 'Admin' or 'Standard' access in your customer account. Kindly verify this by checking under your Google Ads account  > Admin > Access and Security > Users > The email ID has the necessary access level.

Note that you haven't shared the complete API logs as it doesn't contain the request body and the request ID. So, I would request you to share the complete API logs (request and response with request-id and request header) generated at your end to better assist you further. 

[Google Ads API Forum Advisor]

Hi,

After checking your account, I have observed that '4374963390' is a client account and '5709969314' is the MCC Id. In order to avoid the user permission denied error, kindly use the login-customer id as '5709969314' and customer Id as '4374963390'. Make sure that your client account Id (customer Id) must be linked with the MCC Id. I hope this helps, let me know how this goes on your end.

[Nguyen Vien]

How about request id: yXcGOV9UvWHQM6BkKFxBTA and q00JIVm3B4Lb8-plFRRg5Q 
Hope you will response soon. Thanks

[Nguyen Vien]

The strange thing is that I don't pass login_customer_id so why does it have a value 4374963390?  I am using google-ads-python with version 24.0.0

[Google Ads API Forum Advisor]

Hi,

Please be informed that I have removed your response from the forums as it contains the PII information.

Kindly note that you haven’t shared the complete API logs for the request IDs (yXcGOV9UvWHQM6BkKFxBTA and q00JIVm3B4Lb8-plFRRg5Q). I kindly request that you provide the full API logs for these request IDs, similar to what you shared earlier, so we can assist you further. 

Additionally, after reviewing the two accounts (4374963390 and 5709969314), it appears they are not related. The account ID 4374963390 is a client account, which should be used in the customer-id field, while the account ID 5709969314 is a manager account, which should be used in the login-customer-id field. If you are using a developer token linked to the manager account (5709969314) to make an API call for the client account (4374963390), the client account must be linked to the manager account. However, when I checked the manager account (5709969314), I did not find this client account (4374963390) under it.

I recommend referring to the help center article "Link accounts to your manager accounts" for guidance on linking your customer account to the manager account. Once the accounts are linked, please make an API call and let us know the outcome.

Additionally, I noticed that the client account (4374963390) is currently linked to the manager account ID 429-607-3600, but there is no developer token associated with this manager account, so it cannot be used for making API calls.

You can send the details via Reply privately to the author option, or direct private reply to this email.
 

[Nguyen Vien]

Thanks for you response. But why 4374963390 is passed to login-customer-id, I didn't passed anything to login-customer-id in my code. Just call search method of library and leave login_customer_id. I have also checked detail in log, all requests with this error are passed login_customer_id although I don't do it. Please help me response soon. Thanks 

[Li Tom]

Hello Mr. Viên,

I would like to ask if there is any way to create a new account through the Google Ads API with the default country initially set to the United Kingdom. I specify the currency as GBP and the time zone as UK, but when the account is created, it still shows the default billing country as the United States, even though the time zone and currency are correct. Is there a way to create an account with the default billing country set to the UK?

Thanks

Vào lúc 15:36:23 UTC+7 ngày Thứ Tư, 21 tháng 8, 2024, Nguyen Vien đã viết:

[Google Ads API Forum Advisor]

Hi,

I would recommend that you check the login-customer-id value in googleads.yaml file for your google-ads-python client library setup. It is possible that the login-customer-id is being passed from here to your API requests. You may modify the login-customer-id value in googleads.yaml file.

Hope this helps. If you have any more queries, please feel free to get back to us.

[Nguyen Vien]

I don't use googleads.yaml file, I use GoogleAdsClient.load_from_dict(self.CREDENTIALS) method and CREDENTIALS dict not include login_custom_id 

[Nguyen Vien]

Is there a default value for login_customer_id when I don't pass it?

[Nguyen Vien]

Have any news about it? Hope have response soon. Thanks

[Google Ads API Forum Advisor]

Hi,

There is no default value for login_customer_id. If you're not authorizing as a manager account; in other words, if your OAuth 2.0 credentials are for a user of the target Google Ads client account directly, you don't need to supply a login-customer-id header. For more information check this API call structure document.

Hope this clarifies!