Not Accessible another client Account in Google Ads API.

[cooing pop]

Hi,

I have an account about google ads as Master MCC as Root Manager Account 1.

and I want to get customer client ad accounts(Account A, Account B, Account C).

UserCredentials credentials = UserCredentials.newBuilder()
 .setClientId("{Root Manager's client Id}")
 .setClientSecret("{Root Manager's secret}")
 .setRefreshToken("{Root Manager's refresh token}")
 .build();


GoogleAdsClient googleAdsClient = GoogleAdsClient.newBuilder()
 .setCredentials(credentials)
 .setDeveloperToken("{Root Manager's developer token which is ")
 .setLoginCustomerId(Long.parseLong("{Manager Account 2's customer id}"))
 .build();




final String clientQuery =
      "SELECT customer_client.client_customer, customer_client.level "
            + "FROM customer_client";
GoogleAdsServiceClient googleAdsServiceClient = googleAdsClient.getVersion1().createGoogleAdsServiceClient();
SearchGoogleAdsRequest request;
GoogleAdsServiceClient.SearchPagedResponse response;
GoogleAdsServiceClient.SearchPagedResponse customerResponse;


request = SearchGoogleAdsRequest.newBuilder()
      .setCustomerId(String.valueOf(googleAdsClient.getLoginCustomerId()))
      .setPageSize(PAGE_SIZE)
      .setQuery(clientQuery)
      .build();
response = googleAdsServiceClient.search(request)

This is an error.

10:17:06.329 [Gax-3] WARN  c.g.a.googleads.lib.request.summary - FAILURE REQUEST SUMMARY. Method: google.ads.googleads.v1.services.GoogleAdsService/Search, Endpoint: googleads.googleapis.com:443, CustomerID: 6803928870, RequestID: fW3CsG9gHMBZgV4n5lAHvw, ResponseCode: PERMISSION_DENIED, Fault: The caller does not have permission.

Headers: Metadata(content-type=application/grpc,request-id=fW3CsG9gHMBZgV4n5lAHvw,date=Tue, 25 Feb 2020 01:17:06 GMT,alt-svc=quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000)

Body: null

Failure message: errors {

  error_code {

    authorization_error: USER_PERMISSION_DENIED

  }

  message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#login-customer-id"

}

Status: Status{code=PERMISSION_DENIED, description=The caller does not have permission, cause=null}.

Request ID {} failed due to GoogleAdsException. Underlying errors

errors {

  error_code {

    authorization_error: USER_PERMISSION_DENIED

  }

  message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#login-customer-id"

}

How can I get a client account C from within Manager Account 3.

Can I put Manager Account 3 in here

.setLoginCustomerId(Long.parseLong("{Manager Account 3's customer id}"))

and update the UserCredentials above using the OAuth2 certified refresh token of Manager Account3?

.setRefreshToken("{Root Manager certified to Manager Account 3. which returned refresh token}")

Root Manager Account1 can access only Manager Account 2, but can't access Manager Account 3.

When I call acceesible account list API. 

just response data  which include ads manager Account 2.

How can it access Manager Account 3.

I'm not sure I'm missing something.

Do I need to authenticate using the credentials of the master MCC account and specify the customer id as this master account?

I tried but didn't work.

Thank you.

[Joonyeong. Park]

and add Error log

MethodName: google.ads.googleads.v1.services.GoogleAdsService/Search

Endpoint: googleads.googleapis.com:443

Headers: {developer-token=REDACTED, login-customer-id=6803928870, x-goog-api-client=gl-java/1.8.0_111 gapic/ gax/1.35.0 grpc/1.16.1}

Body: customer_id: "6803928870"

query: "SELECT customer_client.client_customer, customer_client.level FROM customer_client"

page_size: 7000

Response

--------

Headers: null

Body: null

Failure message: null

Status: Status{code=UNAVAILABLE, description=Credentials failed to obtain metadata, cause=com.google.api.client.http.HttpResponseException: 401 Unauthorized

at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1072)

at com.google.auth.oauth2.UserCredentials.refreshAccessToken(UserCredentials.java:227)

at com.google.auth.oauth2.OAuth2Credentials.refresh(OAuth2Credentials.java:179)

at com.google.auth.oauth2.OAuth2Credentials.getRequestMetadata(OAuth2Credentials.java:165)

at com.google.auth.Credentials.blockingGetToCallback(Credentials.java:103)

at com.google.auth.Credentials$1.run(Credentials.java:92)

at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)

at java.util.concurrent.FutureTask.run(FutureTask.java:266)

at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)

at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at java.lang.Thread.run(Thread.java:745)

}.

io.grpc.StatusRuntimeException: UNAVAILABLE: Credentials failed to obtain metadata

[Google Ads API Forum Advisor Prod]

Hi All,

@cooing pop - The error USER_PERMISSION_DENIED means that your OAuth2 Client credentials used in your API call are connected to a user who does not have access to the MCC 3. Can you check if your user email has access to this account by logging into MCC 3, then check "Tools and Settings" > "Setup" > "Account Access" and see if the email of your Client Credentials are there? Otherwise, you should use client credentials that have access to MCC 3 to access the account under MCC 3. Let me know if you have further issues.

@ Joonyeong Park - I see that you're using the old version (v1) of Google Ads API Beta. Could you try the request again with the newest version of Google Ads API Beta (v3) and let me know if you still run into issues? If so, could you please provide me with your request and response logs where the error occurs?

Thank you,
Bryan, Google Ads API Team

ref:_00D1U1174p._5001UXVIlu:ref