AuthorizationError.USER_PERMISSION_DENIED

[murali.p...@gmail.com]

Hi,

    

       My Adwords project is authorized for 3 MCC Accounts and I am having 3 refresh token for each. While I am trying to get accounts under them, I am getting [AuthorizationError.USER_PERMISSION_DENIED @ ; trigger:'<null>'] error for two of them . The other one I have been using for last 1 year. Two Accounts shown error were authorized recently .  Please have a look and expecting a solution. 

     

My soap_xml.log looks like


************************************************************
[Oct 08 2015 00:44:57.000000 - ERROR] POST /api/adwords/mcm/v201506/ManagedCustomerService HTTP/1.1
Host: adwords.google.com
Connection: Keep-Alive
User-Agent: PHP-SOAP/5.4.35, gzip
Accept-Encoding: gzip, deflate
Content-Encoding: gzip
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Content-Length: 459
Authorization: Bearer ya29.BgLx4W--UzvPafs0ZynYG0liz5ssILCzDbhTxvuZ41zqBJ4KeWSszynaJKo7zHnBydhrQM8

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="https://adwords.google.com/api/adwords/cm/v201506" xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506">
  <SOAP-ENV:Header>
    <ns2:RequestHeader>
      <ns1:clientCustomerId>XXXXXXXXXXXXX</ns1:clientCustomerId>
      <ns1:developerToken>XXXXXXXXXX</ns1:developerToken>
      <ns1:userAgent>pushGroupAPI (AwApi-PHP/6.2.0, Common-PHP/6.2.0, PHP/5.4.35)</ns1:userAgent>
    </ns2:RequestHeader>
  </SOAP-ENV:Header>
  <SOAP-ENV:Body>
    <ns2:get>
      <ns2:serviceSelector>
        <ns1:fields>CustomerId</ns1:fields>
        <ns1:fields>Name</ns1:fields>
        <ns1:fields>CompanyName</ns1:fields>
        <ns1:fields>CanManageClients</ns1:fields>
        <ns1:fields>CurrencyCode</ns1:fields>
        <ns1:fields>DateTimeZone</ns1:fields>
        <ns1:ordering>
          <ns1:field>Name</ns1:field>
          <ns1:sortOrder>ASCENDING</ns1:sortOrder>
        </ns1:ordering>
      </ns2:serviceSelector>
    </ns2:get>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

HTTP/1.1 500 Internal Server Error
Content-Type: text/xml; charset=UTF-8
Content-Encoding: gzip
Date: Thu, 08 Oct 2015 05:48:17 GMT
Expires: Thu, 08 Oct 2015 05:48:17 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 535
Server: GSE

<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <ns2:ResponseHeader xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506" xmlns="https://adwords.google.com/api/adwords/cm/v201506">
      <requestId>0005219168e5f6090ac278eac50a4b95</requestId>
      <serviceName>ManagedCustomerService</serviceName>
      <methodName>get</methodName>
      <operations>0</operations>
      <responseTime>134</responseTime>
    </ns2:ResponseHeader>
  </soap:Header>
  <soap:Body>
    <soap:Fault>
      <faultcode>soap:Server</faultcode>
      <faultstring>[AuthorizationError.USER_PERMISSION_DENIED @ ; trigger:'&lt;null&gt;']</faultstring>
      <detail>
        <ns2:ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/cm/v201506" xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506">
          <message>[AuthorizationError.USER_PERMISSION_DENIED @ ; trigger:'&lt;null&gt;']</message>
          <ApplicationException.Type>ApiException</ApplicationException.Type>
          <errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AuthorizationError">
            <fieldPath/>
            <trigger>&lt;null&gt;</trigger>
            <errorString>AuthorizationError.USER_PERMISSION_DENIED</errorString>
            <ApiError.Type>AuthorizationError</ApiError.Type>
            <reason>USER_PERMISSION_DENIED</reason>
          </errors>
        </ns2:ApiExceptionFault>
      </detail>
    </soap:Fault>
  </soap:Body>
</soap:Envelope>

[Oct 08 2015 00:44:59.000000 - ERROR] POST /api/adwords/mcm/v201506/ManagedCustomerService HTTP/1.1
Host: adwords.google.com
Connection: Keep-Alive
User-Agent: PHP-SOAP/5.4.35, gzip
Accept-Encoding: gzip, deflate
Content-Encoding: gzip
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Content-Length: 458
Authorization: Bearer ya29.BgJs3Am23dqmwuxFKqgoFCsMstIzI-kRWnB9H_8KOmN0W8rR3lmstYa-5N8T5dOZSOCRwhg

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="https://adwords.google.com/api/adwords/cm/v201506" xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506">
  <SOAP-ENV:Header>
    <ns2:RequestHeader>
      <ns1:clientCustomerId>XXXXXXXXXX</ns1:clientCustomerId>
      <ns1:developerToken>XXXXXXXXXX</ns1:developerToken>
      <ns1:userAgent>pushGroupAPI (AwApi-PHP/6.2.0, Common-PHP/6.2.0, PHP/5.4.35)</ns1:userAgent>
    </ns2:RequestHeader>
  </SOAP-ENV:Header>
  <SOAP-ENV:Body>
    <ns2:get>
      <ns2:serviceSelector>
        <ns1:fields>CustomerId</ns1:fields>
        <ns1:fields>Name</ns1:fields>
        <ns1:fields>CompanyName</ns1:fields>
        <ns1:fields>CanManageClients</ns1:fields>
        <ns1:fields>CurrencyCode</ns1:fields>
        <ns1:fields>DateTimeZone</ns1:fields>
        <ns1:ordering>
          <ns1:field>Name</ns1:field>
          <ns1:sortOrder>ASCENDING</ns1:sortOrder>
        </ns1:ordering>
      </ns2:serviceSelector>
    </ns2:get>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

HTTP/1.1 500 Internal Server Error
Content-Type: text/xml; charset=UTF-8
Content-Encoding: gzip
Date: Thu, 08 Oct 2015 05:48:19 GMT
Expires: Thu, 08 Oct 2015 05:48:19 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 534
Server: GSE

<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <ns2:ResponseHeader xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506" xmlns="https://adwords.google.com/api/adwords/cm/v201506">
      <requestId>0005219168fdc7b00ac2cacacc0bfd41</requestId>
      <serviceName>ManagedCustomerService</serviceName>
      <methodName>get</methodName>
      <operations>0</operations>
      <responseTime>146</responseTime>
    </ns2:ResponseHeader>
  </soap:Header>
  <soap:Body>
    <soap:Fault>
      <faultcode>soap:Server</faultcode>
      <faultstring>[AuthorizationError.USER_PERMISSION_DENIED @ ; trigger:'&lt;null&gt;']</faultstring>
      <detail>
        <ns2:ApiExceptionFault xmlns="https://adwords.google.com/api/adwords/cm/v201506" xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506">
          <message>[AuthorizationError.USER_PERMISSION_DENIED @ ; trigger:'&lt;null&gt;']</message>
          <ApplicationException.Type>ApiException</ApplicationException.Type>
          <errors xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AuthorizationError">
            <fieldPath/>
            <trigger>&lt;null&gt;</trigger>
            <errorString>AuthorizationError.USER_PERMISSION_DENIED</errorString>
            <ApiError.Type>AuthorizationError</ApiError.Type>
            <reason>USER_PERMISSION_DENIED</reason>
          </errors>
        </ns2:ApiExceptionFault>
      </detail>
    </soap:Fault>
  </soap:Body>
</soap:Envelope>

[Oct 08 2015 00:45:01.000000 - INFO] POST /api/adwords/mcm/v201506/ManagedCustomerService HTTP/1.1
Host: adwords.google.com
Connection: Keep-Alive
User-Agent: PHP-SOAP/5.4.35, gzip
Accept-Encoding: gzip, deflate
Content-Encoding: gzip
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Content-Length: 459
Authorization: Bearer ya29.BgKxHwH4vR2aPZWdw1PC1YMUS5JFEPaeyF1oqMfq2PoP9-hEkX-4TwwQHMwEhc6HtucAEIs

<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="https://adwords.google.com/api/adwords/cm/v201506" xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506">
  <SOAP-ENV:Header>
    <ns2:RequestHeader>
      <ns1:clientCustomerId>XXXXXXXXXX</ns1:clientCustomerId>
      <ns1:developerToken>XXXXXXXXXXXXX</ns1:developerToken>
      <ns1:userAgent>pushGroupAPI (AwApi-PHP/6.2.0, Common-PHP/6.2.0, PHP/5.4.35)</ns1:userAgent>
    </ns2:RequestHeader>
  </SOAP-ENV:Header>
  <SOAP-ENV:Body>
    <ns2:get>
      <ns2:serviceSelector>
        <ns1:fields>CustomerId</ns1:fields>
        <ns1:fields>Name</ns1:fields>
        <ns1:fields>CompanyName</ns1:fields>
        <ns1:fields>CanManageClients</ns1:fields>
        <ns1:fields>CurrencyCode</ns1:fields>
        <ns1:fields>DateTimeZone</ns1:fields>
        <ns1:ordering>
          <ns1:field>Name</ns1:field>
          <ns1:sortOrder>ASCENDING</ns1:sortOrder>
        </ns1:ordering>
      </ns2:serviceSelector>
    </ns2:get>
  </SOAP-ENV:Body>
</SOAP-ENV:Envelope>

HTTP/1.1 200 OK
Content-Type: text/xml; charset=UTF-8
Content-Encoding: gzip
Transfer-Encoding: chunked
Date: Thu, 08 Oct 2015 05:48:20 GMT
Expires: Thu, 08 Oct 2015 05:48:20 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

<?xml version="1.0"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <ns2:ResponseHeader xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506" xmlns="https://adwords.google.com/api/adwords/cm/v201506">
      <requestId>00052191691543680ac2cacacc0bfd41</requestId>
      <serviceName>ManagedCustomerService</serviceName>
      <methodName>get</methodName>
      <operations>1</operations>
      <responseTime>374</responseTime>
    </ns2:ResponseHeader>
  </soap:Header>
  <soap:Body>
    <ns2:getResponse xmlns="https://adwords.google.com/api/adwords/cm/v201506" xmlns:ns2="https://adwords.google.com/api/adwords/mcm/v201506">
      <ns2:rval>
        <totalNumEntries>557</totalNumEntries>
        <Page.Type>ManagedCustomerPage</Page.Type>
        <ns2:entries>
          <ns2:name>XXXXXXXXXXXXXXX</ns2:name>
          <ns2:companyName/>
          <ns2:customerId>XXXXXXXXXXXX</ns2:customerId>
          <ns2:canManageClients>true</ns2:canManageClients>
          <ns2:currencyCode>GBP</ns2:currencyCode>
          <ns2:dateTimeZone>Etc/GMT</ns2:dateTimeZone>
        </ns2:entries>
        <ns2:entries>
          <ns2:name>


******************************************************************************************************888



Thank you in advance

Murali Mohan

[Umesh Dengale]

Hi Murali,

You could use the ManagedCustomerService to link your AdWords account under the above mentioned two MCC account. Check out Extending invitations and Get pending invitations section of the Managing Customer Accounts guide. Please refer this forum discussion on similar topic.

Cheers,

Umesh, AdWords API Team.

[murali.p...@gmail.com]

Hi,

   Thank you for your reply. But which is not the actual solution we need.

        What we are trying here is that:

1. We have the Adwords App registered in the Developer Console.
2. We are using the clientSecret, clientId and redirectURI from this app.
3. In our application, other Adwords users can log in and provide Adwords API access to our App. We do this successfully, to get accessToken and refreshToken for each MCC.

           What we want to do is, access the MCC details via API using these information. Is it possible with a simple grant access  (which redirects the user to Adwords/Google). We do not want to send invitations via API, the user should be able to grant access via our app  through adwords.google.com. I am sure this is possible, as I have seen sites do this. What am I missing here?

 Thank you in advance

Murali Mohan

[Nadine Sundquist (AdWords API Team)]

Hi Murali,

It sounds like you're trying to create a website where people can authorize you to have access to their account and then use your program. If that's the case OAuth 2.0 has two different way of doing authorization. One is for installed applications and the other is for web flow. Check out the web flow option to see if it matches what you're trying to do.

Cheers,

Nadine, AdWords API Team

[Mhamad Canaan]

Hi,

I have a similar problem, but for me I have managed to authorize my app and accessed the accounts, but I still one thing more.

When a MCC account authenticates the  [canManageClients] => 1  tells me that it is an MCC. but what if I want to manage one of the clients this account manages how can I fetch the clients he manages?

Waiting your reply,

Best regards,

Mohammad Canaan

[Nadine Sundquist (AdWords API Team)]

Hello Mohammad,

If you want to get the clients of a manager account (MCC), then you would use the ManagedCustomerService. By using the get() method of that service, you can follow the links down in your account to build a hierarchy of accounts from your manager account. Our client libraries have examples on getting the account hierarchy. If you're using Java, check out the GetAccountHierarchy.java example.

Best,

Nadine, AdWords API Team