About USER_PERMISSION_DENIED

[LI1F]

Hi Google Ads API Team,

I have two MCC accounts under my GCP account.

Originally, there was only one account, and with the first account, I obtained a refresh_token, client_id, and client_secret.

Using the developer-token and login-customer-id from the first MCC account, I can successfully retrieve the information I need by calling the following API:

requestUrl = https://googleads.googleapis.com/v17/customers/login-customer-id/googleAds:searchStream

requestString = {"query":"SELECT customer_client.client_customer, customer_client.descriptive_name, customer_client.time_zone, customer_client.id FROM customer_client WHERE customer_client.level <= 1 AND customer_client.status = 'ENABLED'"}

However, with the newly added MCC account, using the same refresh_token, client_id, and client_secret, but replacing with the new MCC account’s developer-token and login-customer-id, I get the following error:

[{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.ads.googleads.v17.errors.GoogleAdsFailure",
        "errors": [
          {
            "errorCode": {
              "authorizationError": "USER_PERMISSION_DENIED"
            },
            "message": "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid"
          }
        ],
        "requestId": "saB0ALwweWxAmkTgmy4t6Q"
      }
    ]
  }
}
]

I have confirmed that the new MCC account’s developer-token has basic access, and the account has been granted the necessary permissions.

What else could cause a USER_PERMISSION_DENIED error?

[Google Ads API Forum Advisor]

Hi,

Thank you for reaching out to the Google Ads API support team.

I could see that you are encountering a USER_PERMISSION_DENIED authorization error, it means the user doesn't have permission to access the customer. According to the documentation, if you're accessing the customer, please specify the login-customer-id as the manager account ID without hyphens (-). Also, please check if you have the correct access level to the Google Ads account that you are accessing. Kindly note that we don't block any IPs and the only error logs are not sufficient to assist you.

To analyze your issue further could you please provide us with the below details.

• Execute List Accessible Customers and provide us complete API request and response logs, you may also check this API documentation for more information.
• The user email is used for generating the OAuth credentials i.e, refresh token.
• Complete API logs (request and response with request-id and request header) generated at your end.

If you are using a client library and haven't enabled the logging yet, I would request you to enable logging for the specific client library that you are using. You can refer to the guides Java, .Net, PHP, Python, Ruby or Perl to enable logging at your end. For REST interface requests, you can enable logging via the curl command by using the -i flag.

 You can send the details via Reply privately to the author option, or direct private reply to this email.

 

This message is in relation to case "ref:!00D1U01174p.!5004Q02vENzQ:ref" (ADR-00260406)

Thanks,
 

Google Ads API Team

​​​​​​​