RE: listinvoice rest api response permission_denied

[Google Ads API Forum Advisor]

Hi,

Thank you for reaching out to the Google Ads API support team.

Please be informed that I have removed your response from the forums as it contains the PII information.

I understand that you're facing an ACTION_NOT_PERMITTED error while accessing the Google invoice service API. This error occurs when the user does not have permission to perform this action (for example, ADD, UPDATE, REMOVE) on the resource or call a method. Kindly note that could you confirm whether you have added your email ID that is used to generate the OAuth credentials is listed as 'Admin' or 'Standard' access in your customer account. Kindly verify this by checking under your Google Ads account > Admin > Access and Security > Users > The authenticated email ID with 'Standard' or 'Admin' access level. I would recommend you to refer to the help center article "Manage access to your Google Ads account" for more information. Also, kindly check if you have the correct access level to the Google Ads account that you are accessing. Also, could you provide us with the below details.

• Execute List Accessible Customers and provide us complete API request and response logs, you may also check this API documentation for more information.
• The user email is used for generating the OAuth credentials i.e, refresh token.
• Upon checking your account (3063874396), I could see that there is one email ID (liuji...@gmail.com) present in your account with read-only access. 
• If this is the email which is used for authenticating the API requests then you need to provide this email ID with 'Admin' or 'Standard' access level. 

You can send the details via Reply privately to the author option, or direct private reply to this email.
 

This message is in relation to case "ref:!00D1U01174p.!5004Q02vGp2A:ref" (ADR-00278785)

Thanks,
 

Google Ads API Team

Feedback
How was our support today?

               

 

 

 

[陶雨]

listAccessibleCustomers

https://googleads.googleapis.com/v17/customers:listAccessibleCustomers

response

{

"resourceNames": [

"customers/8482480117",

"customers/8691620764",

"customers/5085446266"

]

}

Google Ads API Forum Advisor <ads...@forumsupport.google> 于2024年12月16日周一 13:31写道：

[陶雨]

I changed the account to call the API.
email: tuca...@wepie.com
requestId: xRn7afDPTcK138wi1Ty35w


https://content-googleads.googleapis.com/v17/customers/3063874396/invoices?billingSetup=customers%2F3063874396%2FbillingSetups%2F664581320&issueYear=2024&issueMonth=NOVEMBER
response:

{

"error": {

"code": 403,

"message": "The caller does not have permission",

"status": "PERMISSION_DENIED",

"details": [

{

"@type": "type.googleapis.com/google.ads.googleads.v17.errors.GoogleAdsFailure",

"errors": [

{

"errorCode": {

"authorizationError": "ACTION_NOT_PERMITTED"

},

"message": "The user does not have permission to perform this action on the resource or call a method."

}

],

"requestId": "sHHcQ7-ydVMhXF5qe25rbA"

}

]

}

}

陶雨 <chac...@gmail.com> 于2024年12月16日周一 20:22写道：

[陶雨]

tuca...@domain.com has administrator privileges, but it says PERMISSION_DENIED. Do I need other privileges?
In addition: We pay through an agent, will API calls be applied?

Could you help hide the email domains of the first few replies?

陶雨 <chac...@gmail.com> 于2024年12月16日周一 20:25写道：

[Google Ads API Forum Advisor]

Hi,

Upon checking your account, I see that the mentioned email 'tuca...@wepie.com' is not a user in the account 306-387-4396. This might be the reason for getting a PERMISSION_DENIED error. I would recommend that you add the email 'tuca...@wepie.com' as a user for the account 306-387-4396 and try making the API call. Also, note that the user email ID (uca...@wepie.com) is used for generating the OAuth credentials should be linked with your client account, that client account is correctly linked to the appropriate MCC account and that the developer token used in the API calls is valid. Also, make sure that the email ID (uca...@wepie.com) used to generate the OAuth credentials is listed as having 'Admin' or 'Standard' access in your customer account.

[Google Ads API Forum Advisor]

Hi,

I understand that you are using Invoice Service and getting PERMISSION_DENIED error. Please note that the login-customer-id must specify the customer ID of a manager account that is managing the Google Ads account for which you're retrieving invoices. This is labeled as the paying manager in the Google Ads UI. Upon checking, I see that your paying manager is '837-538-6243'. Kindly try again with login customer id as '837-538-6243' and let us how it goes on your end.

[Melissa Annette Martinez]

Let me check and see if I added 9518

Melissa martinez

On Mon, Dec 16, 2024, 6:52 AM Melissa Annette Martinez <melissaan...@gmail.com> wrote:

Liujie9518 I don't think I added that

My admun address would be melissaan...@gmail.com
Melissaan...@gmail.com
Both should have admin access

Melissa martinez

--
--
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
Also find us on our blog:
https://googleadsdeveloper.blogspot.com/
=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~=~
 
You received this message because you are subscribed to the Google
Groups "AdWords API and Google Ads API Forum" group.
To post to this group, send email to adwor...@googlegroups.com
To unsubscribe from this group, send email to
adwords-api...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/adwords-api?hl=en
---
You received this message because you are subscribed to the Google Groups "Google Ads API and AdWords API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to adwords-api...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/adwords-api/CAFEWMdTyYB%2BOKPOO1h9xxyHs8DGToezaVN%2B3h3rZdLxKHYhLYA%40mail.gmail.com.

[Melissa Annette Martinez]

Liujie9518 I don't think I added that

My admun address would be melissaan...@gmail.com
Melissaan...@gmail.com
Both should have admin access

Melissa martinez

On Mon, Dec 16, 2024, 6:30 AM 陶雨 <chac...@gmail.com> wrote:

[陶雨]

The email tu*****@domain.com is an administrator of the manager account (848-248-0117) to which 306-387-4396 belongs. 

Does it still need to be added to the 306-387-4396 account?

RequestId：PH_jqbh0srJlozs20r9zjw

Google Ads API Forum Advisor <ads...@forumsupport.google> 于2024年12月17日周二 01:07写道：

[陶雨]

I understand that to get the bill, I need to use the account of the payment manager.
The payment manager is an agent, not an internal employee, and does not have the authority to access his account.
Do you have any solution to obtain the authority? Or is there any other way?

Google Ads API Forum Advisor <ads...@forumsupport.google> 于2024年12月17日周二 05:41写道：

[Google Ads API Forum Advisor]

Hi,

Kindly note that you need to specify the email ID (tuca...@wepie.com) in your client account (306-387-4396) with 'Admin' or 'Standard' access. The only way to avoid the ACTION_NOT_PERMITTED error is by adding the authenticated email ID to the client account. The reason you are encountering the ACTION_NOT_PERMITTED error is related to the access level of the user associated with the refresh token you are using to make the API request. This concept is explained in detail in this video.

I would suggest you to create a new refresh token that is associated with an email address of a user who has Standard or Admin access and retrying the API request with this new refresh token, which should resolve your issue.