GAM Vault Download export failing

301 views
Skip to first unread message

KevinAurora

unread,
Jun 21, 2019, 12:42:58 PM6/21/19
to GAM for G Suite
I've successfully created a number of vault exports.  When I attempt to download a completed export I'm getting errors.  The docs show using matter-ID and export-ID.  I figured out that GAM is expecting names for each of these rather than the internal ID.  (I'll go submit a feature request for the possibility of supporting either)  

I would love some help on where I'm going wrong.  I have around a hundred of these to download and am not looking forward to having to click through the GUI if I can't make this work.

Details:
$ gam version
Python 3.7.3 64-bit final
google-api-python-client 1.7.8
oauth2client 4.1.3
Darwin-18.5.0-x86_64-i386-64bit x86_64
Path: /Users/me/gam/GAM-4.85bin

$ gam oauth info

OAuth File: /Users/me/gam/GAM-4.85bin/oauth2.txt
Client ID: 307997[REACTED].apps.googleusercontent.com
Secret: [REDACTED]
Scopes (27):
  openid
G Suite Admin: me@mycompany


$ gam download export "My Matter" "My-DriveFiles Query1 Batch 1"  noextract targetfolder /Volumes/foo/

saving to /Volumes/foo/[REDACTED-MATTER-ID]exportly-[REDACTED-EXPORT-ID]-My-DriveFiles_Query1_Batch_1-custodian-docid.csv
Traceback (most recent call last):
  File "gam.py", line 14293, in <module>
  File "gam.py", line 13969, in ProcessGAMCommand
  File "gam.py", line 8193, in doDownloadVaultExport
  File "site-packages/googleapiclient/_helpers.py", line 130, in positional_wrapper
  File "site-packages/googleapiclient/http.py", line 705, in next_chunk
googleapiclient.errors.HttpError: <HttpError 403 when requesting https://www.googleapis.com/storage/v1/b/3096e414-aedd-464c-a0e7-266cfe706618/o/[REDACTED-MATTER-ID]%2Fexportly-[REDACTED-EXPORT-ID]%2My-DriveFiles_Query1_Batch_1-custodian-docid.csv?alt=media returned "Forbidden">
[84387] Failed to execute script gam

Ross Scroggs

unread,
Jun 21, 2019, 1:02:24 PM6/21/19
to google-ap...@googlegroups.com
Kevin,

You can use the internal IDs by specifying id:12345

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/535c1a27-e646-46c7-86c7-2df7a899de22%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


--

KevinAurora

unread,
Jun 21, 2019, 1:11:36 PM6/21/19
to GAM for G Suite
Ross,
Awesome - thanks for the tip.  I re-tried using the Id for both matter and export w/ unfortunately the same results.  On the plus side, not having to do the name lookups got it to fail much faster. :-)

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://www.googleapis.com/storage/.........-metadata.xml?alt=media returned "Forbidden">
[85089] Failed to execute script gam

Jay Lee

unread,
Jun 21, 2019, 1:35:46 PM6/21/19
to google-ap...@googlegroups.com
What happens when you login to ediscovery.google.com as the same user you are using with GAM and try to download the exports?

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/68fe1b47-14e7-4663-b895-ce7fec0ba426%40googlegroups.com.

KevinAurora

unread,
Jun 21, 2019, 1:47:32 PM6/21/19
to GAM for G Suite
Jay,
I have no issues downloading  completed exports from the vault GUI.  And I am the same user for GAM and vault.


On Friday, June 21, 2019 at 10:35:46 AM UTC-7, Jay Lee wrote:
What happens when you login to ediscovery.google.com as the same user you are using with GAM and try to download the exports?

On Fri, Jun 21, 2019 at 1:11 PM KevinAurora <ke...@aurora.tech> wrote:
Ross,
Awesome - thanks for the tip.  I re-tried using the Id for both matter and export w/ unfortunately the same results.  On the plus side, not having to do the name lookups got it to fail much faster. :-)

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://www.googleapis.com/storage/.........-metadata.xml?alt=media returned "Forbidden">
[85089] Failed to execute script gam

On Friday, June 21, 2019 at 10:02:24 AM UTC-7, Ross Scroggs wrote:
Kevin,

You can use the internal IDs by specifying id:12345

Ross


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.

Jay Lee

unread,
Jun 21, 2019, 1:51:47 PM6/21/19
to google-ap...@googlegroups.com
And does the URL for the download match what's seeing the 403 from GAM?

Jay

On Fri, Jun 21, 2019 at 1:47 PM KevinAurora <ke...@aurora.tech> wrote:
Jay,
I have no issues downloading  completed exports from the vault GUI.  And I am the same user for GAM and vault.


On Friday, June 21, 2019 at 10:35:46 AM UTC-7, Jay Lee wrote:
What happens when you login to ediscovery.google.com as the same user you are using with GAM and try to download the exports?

On Fri, Jun 21, 2019 at 1:11 PM KevinAurora <ke...@aurora.tech> wrote:
Ross,
Awesome - thanks for the tip.  I re-tried using the Id for both matter and export w/ unfortunately the same results.  On the plus side, not having to do the name lookups got it to fail much faster. :-)

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://www.googleapis.com/storage/.........-metadata.xml?alt=media returned "Forbidden">
[85089] Failed to execute script gam

On Friday, June 21, 2019 at 10:02:24 AM UTC-7, Ross Scroggs wrote:
Kevin,

You can use the internal IDs by specifying id:12345

Ross


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/67136e91-427c-4024-a293-dc8cdfd76040%40googlegroups.com.

KevinAurora

unread,
Jun 21, 2019, 4:53:28 PM6/21/19
to GAM for G Suite
Jay,
The URLs aren't a match.  It looks like from the e-discovery side there is a sequential index rather than full named file.  It isn't clear that this is just a function of not presenting the API URL or if there's a functional difference.

(FYI I've sanitized matter-Id and export ID below via search and replace)


From the ediscovery GUI:

My-DriveFiles_Query1_Batch_1-custodian-docid.csv (2.4k)
My-DriveFiles_Query1_Batch_1-metadata.xml (18k)
My-DriveFiles_Query1_Batch_1_0.zip (3.1M)
File checksums


$ gam download export id:[matter-aa-bb-ccc] id:[exportly-xx-yy-zzz] noextract 
saving to /Users/kmoore/gam/GAM-4.85bin/[matter-aa-bb-ccc]-[exportly-xx-yy-zzz]-My-DriveFiles_Query1_Batch_1-custodian-docid.csv
Traceback (most recent call last):
  File "gam.py", line 14293, in <module>
  File "gam.py", line 13969, in ProcessGAMCommand
  File "gam.py", line 8193, in doDownloadVaultExport
  File "site-packages/googleapiclient/_helpers.py", line 130, in positional_wrapper
  File "site-packages/googleapiclient/http.py", line 705, in next_chunk
[85660] Failed to execute script gam


On Friday, June 21, 2019 at 10:51:47 AM UTC-7, Jay Lee wrote:
And does the URL for the download match what's seeing the 403 from GAM?

Jay

On Fri, Jun 21, 2019 at 1:47 PM KevinAurora <ke...@aurora.tech> wrote:
Jay,
I have no issues downloading  completed exports from the vault GUI.  And I am the same user for GAM and vault.


On Friday, June 21, 2019 at 10:35:46 AM UTC-7, Jay Lee wrote:
What happens when you login to ediscovery.google.com as the same user you are using with GAM and try to download the exports?

On Fri, Jun 21, 2019 at 1:11 PM KevinAurora <ke...@aurora.tech> wrote:
Ross,
Awesome - thanks for the tip.  I re-tried using the Id for both matter and export w/ unfortunately the same results.  On the plus side, not having to do the name lookups got it to fail much faster. :-)

googleapiclient.errors.HttpError: <HttpError 403 when requesting https://www.googleapis.com/storage/.........-metadata.xml?alt=media returned "Forbidden">
[85089] Failed to execute script gam

On Friday, June 21, 2019 at 10:02:24 AM UTC-7, Ross Scroggs wrote:
Kevin,

You can use the internal IDs by specifying id:12345

Ross


--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.

Danny

unread,
Jul 29, 2019, 9:55:43 AM7/29/19
to GAM for G Suite
Hey,

I'm having this issue as well, identical errors as Kevin.

Were you able to get a fix for this?

User 3902

unread,
Aug 8, 2019, 2:00:46 PM8/8/19
to GAM for G Suite
I am also having the exact same issue. The user I auth gam with can download the files in ediscovery console one the web, and the URLs do not match. I get the same 403 forbidden.

I set this project up today on a new system so scope access shouldn't be expired, but I followed the steps in this post anyways with no luck either. Seems like the problem lies in the URLs being generated?

Experiencing this on multiple systems (Windows and GNU/Linux).
Reply all
Reply to author
Forward
0 new messages