USER_PERMISSION_DENIED

[Brian Maynard]

Hi,

I followed the following info in this youtube video

https://www.youtube.com/watch?v=WifY2fFyaMw

Yes, I know it's old> but I must say it was very helpful. I have also created a developer token. Still in test mode and have created the OAuth2 for an application. Once I did that. I created a refresh token and then pasted the response info into my app.config file.

I have also created a test account to be used with the dev token, as it's still in testing.

I am also using the examples V8 which I downloaded. 

Now I will start with what does work. If I run: AccountManagement\CreateCustomer.cs. It creates a customer in my test account successfully as below.

This code example illustrates how to create a new customer under a given manager account.

Note: this example must be run using the credentials of a Google Ads manager account. By default, the new account will only be accessible via the manager account.

Created a customer with resource name 'customers/1063876605' under the manager account with customer ID 'xxxxxxxxx'

I then created a test campaign under the newly created customer, although it's still in draft status. Not sure if this is relevant.

Now for what doesn't work:

If I run BasicOperations\GetCampaigns and set my manager account ID in the config file under <add key = 'LoginCustomerId' value = xxxxxxx /> and the customer ID as the one created above. It returns the following

G:\My Projects\C#\Google ads\Latest examples\google-ads-dotnet-main\examples\bin\Debug\netcoreapp3.0\Google.Ads.GoogleAds.Examples.exe (process 13496) exited with code 0.

To automatically close the console when debugging stops, enable Tools->Options->Debugging->Automatically close the console when debugging stops.

Press any key to close this window . . .

But if I don't configur <add key = 'LoginCustomerId'  value = xxxxxxx />   in the config file and still use the account ID as created above. I get the following:

This code example gets all campaigns. To add campaigns, run AddCampaigns.cs.

Failure:

Message: Status(StatusCode="PermissionDenied", Detail="The caller does not have permission", DebugException="Grpc.Core.Internal.CoreErrorDetailException: {"created":"@1633431129.992000000","description":"Error received from peer ipv4:216.58.223.74:443","file":"..\..\..\src\core\lib\surface\call.cc","file_line":1068,"grpc_message":"The caller does not have permission","grpc_status":7}")

Failure: { "errors": [ { "errorCode": { "authorizationError": "USER_PERMISSION_DENIED" }, "message": "User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid" } ], "requestId": "hgLMtllTEEhwDDnuFIlEOw" }

Request ID: hgLMtllTEEhwDDnuFIlEOw

So why is it that I have permission to create a customer, but I don't have permission to do anything else?

Thanks

[Google Ads API Forum Advisor]

Hi Brian,

Thank you for raising your concern and for providing detailed information of the concern.

I would suggest first to refer to this document to know the call structure of Google Ads API. It discussed there that it is needed to set the customer ID (without hyphens) of the manager account where your login user account has access and used to generate oauth2 credential. This is the reason why the USER_PERMISSION_DENIED error occurred when not configuring or setting customer ID to LoginCustomerId field.

Let me know if you have further questions.

Regards,

Ernie John Blanca Tacata Google Ads API Team

ref:_00D1U1174p._5004Q2OWknx:ref

[Brian Maynard]

Thanks,

I got it to work

[Héctor Urbina]

Hello,

I had this problem also for a number of use cases. After adding the manager's customer id in the ads client build, most of them were solved, but not all of them. Now, I have a couple of use cases in which, even when though the login-customer-id goes as a request header, the response gives me this:

Headers: {

  "google.ads.googleads.v8.errors.googleadsfailure-bin": "\n\u0001\n\u0002H\u0002\u0012\u0001User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid\u0012\u0016OlF4Ln0gLpOUnCTivOoOGA",

  "grpc-status-details-bin": "\b\u0007\u0012#The caller does not have permission\u001a\u0002\nCtype.googleapis.com/google.ads.googleads.v8.errors.GoogleAdsFailure\u0012\u0002\n\u0001\n\u0002H\u0002\u0012\u0001User doesn't have permission to access customer. Note: If you're accessing a client customer, the manager's customer id must be set in the 'login-customer-id' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid\u0012\u0016OlF4Ln0gLpOUnCTivOoOGA",

  "request-id": "OlF4Ln0gLpOUnCTivOoOGA"

}

Fault: errors {

  error_code {

    authorization_error: USER_PERMISSION_DENIED

  }

  message: "User doesn\'t have permission to access customer. Note: If you\'re accessing a client customer, the manager\'s customer id must be set in the \'login-customer-id\' header. See https://developers.google.com/google-ads/api/docs/concepts/call-structure#cid"

}

What could be wrong here?