Got Permission error - USER_PERMISSION_DENIED in Google Ads API, while it works on Adwords API

[Omri Gal]

Hi,

When I tried to migrate one of my customers to pull data from the new Google Ads API, I receive the following error:

Fault: errors {
  error_code {
    authorization_error: USER_PERMISSION_DENIED
  }
  message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#login-customer-id"
}


"request-id": "vyQvJKsGKGzJOVFRga7PXg"

I asked the customer to perform OAuth again, but I still receive the same error.

This hadn't happened to any other customer I migrated until now.

More information will be sent privately.

Best regards,

Omri G.

[Google Ads API Forum Advisor Prod]

Hi Omri,

Thanks for reaching out. The error USER_PERMISSION_DENIED usually occurs when there is no link between the manager account authenticated in the request and the client account specified in the headers. As the customer switched from Adwords API to Google Ads API they need to include the login-customer_id in the header as mentioned in this blog post. If the issue persist, could you please send me the complete SOAP request and response along with the client customer id via Reply privately to the author option?

Thanks and regards,
Xiaoming, Google Ads API Team

 

 

 

ref:_00D1U1174p._5001USwXi1:ref

[Ajit Trivedi]

Hi, Can you please explain a little more about how we can fix this issue?

[Google Ads API Forum Advisor]

Hi Ajit,

Here's our login customer Id guide and migration guide.

Any account returned by Get Account Hierarchy when you you don't specify manager ID and login customer ID can be accessed by your refresh token you used to make the API call.

Any account returned by List Accessible Accounts when using a specific refresh token doesn't need the login customer Id.

Another property of those accounts returned by List Accessible Accounts is they are the only accounts that can be a login customer Id for the specific refresh token making the API call.

A visual way to explain this is to imagine that the same Google account that generated the refresh token was to access an account in the Ads UI. They will see all the the accounts that List Accessible Accounts returns in the top right drop down list when you click the circle representation of the user in the UI. These are accounts the user has direct access to. If an account in that list is an MCC with child accounts attached, then to see the child accounts you would select that MCC in the top right of the UI and then the child accounts are accessible in the top left - middle accounts drop down list box in the UI. These are the same accounts that Get Account Hierarchy shows. 

To access accounts that are in the top left - middle accounts drop down list box via the API you would put the selected account in the top right list in the UI as login customer Id, and you would put the selected account in the top left - middle accounts drop down list box as the operating customer.

In light of the above, if you are still experiencing this error, could you send us a 'DEBUG' log level request and response log of raw API communications returning this error,  combined with the Google Account that generated the refresh token used?

The request and response appears similar to the JSON Mappings in our REST documentation with additional headers and information such as request Id. Here are logging instructions for our Java, .NET, PHP, Python, Ruby and Perl Ads API Client Libraries.

If you are using our REST interface then the full multi line curl command line is a request log and adding curl command line option '-i' will also generate a response log.

You may send the requested information via "Reply to author" or via googleadsa...@google.com with a link to this forum post added to the new thread.

Regards,

Aryeh Google Ads API Team

ref:_00D1U1174p._5001USwXi1:ref