Error message of "User doesn't have permission to access customer", but my user does have permission.

[Rachel Suddeth]

The scenario: - I have authorized to use customer id of 6363265550, which is a manager account. I want to look for information on customer 8161358072, which is managed by 6363265550. Here is what is being logged. Method: /google.ads.googleads.v9.services.GoogleAdsService/Search Host: googleads.googleapis.com Headers: { "developer-token": "REDACTED", "linked-customer-id": "8161358072", "login-customer-id": "6363265550", "x-goog-api-client": "gl-python/3.8.12 grpc/1.42.0 gax/2.2.2 gccl/14.1.0", "x-goog-request-params": "customer_id=8161358072" } Request: customer_id: "8161358072" query: "SELECT customer.descriptive_name, customer.conversion_tracking_setting.cross_account_conversion_tracking_id, customer.time_zone FROM customer WHERE customer.id = 8161358072" page_size: 1000 Response ------- Headers: { "google.ads.googleads.v9.errors.googleadsfailure-bin": "\n\u0001\n\u0002H\u0002\u0012\u0001User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid\u0012\u0016HcvNuecETNXmZqsUAU1gFA", "grpc-status-details-bin": "\b\u0007\u0012#The caller does not have permission\u001a\u0002\nCtype.googleapis.com/google.ads.googleads.v9.errors.GoogleAdsFailure\u0012\u0002\n\u0001\n\u0002H\u0002\u0012\u0001User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid\u0012\u0016HcvNuecETNXmZqsUAU1gFA", "request-id": "HcvNuecETNXmZqsUAU1gFA" } Fault: errors { error_code { authorization_error: USER_PERMISSION_DENIED } message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid" } request_id: "HcvNuecETNXmZqsUAU1gFA" [WARNING] 2022-03-01T17:35:20.088Z 7a161f66-8ddc-48f0-8352-90f184b7115d Request made: ClientCustomerId: 8161358072, Host: googleads.googleapis.com, Method: /google.ads.googleads.v9.services.GoogleAdsService/Search, RequestId: HcvNuecETNXmZqsUAU1gFA, IsFault: True, FaultMessage: User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid [ERROR] 2022-03-01T17:35:20.088Z 7a161f66-8ddc-48f0-8352-90f184b7115d Exception caught in decorator: Traceback (most recent call last): File "/var/task/helper/search_utility.py", line 82, in queryWithPaging return googleAdsService.search(search_request) File "/var/task/google/ads/googleads/v9/services/services/google_ads_service/client.py", line 3184, in search response = rpc( File "/var/task/google/api_core/gapic_v1/method.py", line 154, in __call__ return wrapped_func(*args, **kwargs) File "/var/task/google/api_core/grpc_helpers.py", line 66, in error_remapped_callable return callable_(*args, **kwargs) File "/var/task/grpc/_interceptor.py", line 216, in __call__ response, ignored_call = self._with_call(request, File "/var/task/grpc/_interceptor.py", line 257, in _with_call return call.result(), call File "/var/task/grpc/_interceptor.py", line 126, in result raise self._exception File "/var/task/grpc/_interceptor.py", line 241, in continuation response, call = self._thunk(new_method).with_call( File "/var/task/grpc/_interceptor.py", line 266, in with_call return self._with_call(request, File "/var/task/grpc/_interceptor.py", line 257, in _with_call return call.result(), call File "/var/task/grpc/_interceptor.py", line 126, in result raise self._exception File "/var/task/grpc/_interceptor.py", line 241, in continuation response, call = self._thunk(new_method).with_call( File "/var/task/grpc/_interceptor.py", line 266, in with_call return self._with_call(request, File "/var/task/grpc/_interceptor.py", line 254, in _with_call call = self._interceptor.intercept_unary_unary(continuation, File "/var/task/google/ads/googleads/interceptors/exception_interceptor.py", line 99, in intercept_unary_unary self._handle_grpc_failure(response) File "/var/task/google/ads/googleads/interceptors/exception_interceptor.py", line 71, in _handle_grpc_failure raise self._get_error_from_response(response) google.ads.googleads.errors.GoogleAdsException: (<_InactiveRpcError of RPC that terminated with: status = StatusCode.PERMISSION_DENIED details = "The caller does not have permission" debug_error_string = " { "created": "@1646156119.387356371", "description": "Error received from peer ipv4:172.217.9.202:443", "file": "src/core/lib/surface/call.cc", "file_line": 1063, "grpc_message": "The caller does not have permission", "grpc_status": 7 } " >, <_InactiveRpcError of RPC that terminated with: status = StatusCode.PERMISSION_DENIED details = "The caller does not have permission" debug_error_string = " { "created": "@1646156119.387356371", "description": "Error received from peer ipv4:172.217.9.202:443", "file": "src/core/lib/surface/call.cc", "file_line": 1063, "grpc_message": "The caller does not have permission", "grpc_status": 7 } " >, errors { error_code { authorization_error: USER_PERMISSION_DENIED } message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid" } request_id: "HcvNuecETNXmZqsUAU1gFA" , 'HcvNuecETNXmZqsUAU1gFA')

[Rachel Suddeth]

Just to show that the manager account is indeed authorized, and that the client account does belong to the manager account, there is a query with a successful result:

[DEBUG] 2022-03-01T17:52:25.454Z 15cf012b-bac8-4f6a-bc0c-559ab45eb9ea Request ------- Method: /google.ads.googleads.v9.services.GoogleAdsService/Search Host: googleads.googleapis.com
Headers: {

 "developer-token": "REDACTED",

 "login-customer-id": "6363265550", 

"x-goog-api-client": "gl-python/3.8.12 grpc/1.42.0 gax/2.2.2 gccl/14.1.0",

 "x-goog-request-params": "customer_id=6363265550" }
Request: customer_id: "6363265550"
query: "\n SELECT\n customer_client.id,\n FROM \n customer_client\n WHERE\n customer_client.manager = FALSE\n " 

page_size: 1000 

Response ------- Headers: 

{ "alt-svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\"", "content-disposition": "attachment", "date": "Tue, 01 Mar 2022 17:52:25 GMT", "request-id": "_1JlfaFEUYSTiq2LhC7qDA" }

Response:

 results { customer_client { resource_name: "customers/6363265550/customerClients/6945759442" id: 6945759442 } }

 results { customer_client { resource_name: "customers/6363265550/customerClients/8161358072"  id: 8161358072 } } 

results { customer_client { resource_name: "customers/6363265550/customerClients/4244915335" id: 4244915335 } ...
 } field_mask { paths: "customer_client.id"" }

[Rachel Suddeth]

We have large customers that use these manager accounts, so it's crucial to the business that we get this fixed. Right now this error is keeping some of the largest customers from getting what they want from Google Ads.

[Rachel Suddeth]

Finally got it figure out. I assumed the "linked_customer_id" could be set to a managed account id. I got rid of the code that set the "linked_customer_id" and the query worked.