Upload Offline Conversions (Java) : 403 Error

[Elena Lozano]

Hello!

I am trying to upload offline conversions to a specific floodlight using a service account and I am getting the following error:

 

{

  "code" : 403,

  "errors" : [ {

    "domain" : "global",

    "message" : "Insufficient Permission",

    "reason" : "insufficientPermissions"

  } ],

  "message" : "Request had insufficient authentication scopes.",

  "status" : "PERMISSION_DENIED"

}

  

This is my java code for the autentication:

 InputStream credentials= StorageUtils.getFileAsInputStream([MY_JSON]);

GoogleCredential credential = GoogleCredential                                                         .fromStream(credentials)                                                               .createScoped(DfareportingScopes.DDMCONVERSIONS);

           

 

If I change the scope to  DfareportingScopes. DFATRAFFICKING and ask about my userRolePermissions with this Java code: 

 

UserRolePermissionsListResponse rolepermis = reporting.userRolePermissions().list(profileId).execute();

             for (int j = 0; j < rolepermis.getUserRolePermissions().size(); j++) {

                System.out.println(rolepermis.getUserRolePermissions().get(j).getName());

               }

 

I can see that i have this one “Insert offline conversions"

 

So why i have the 403 error when im trying to upload offline conversions

 Thanks in advance!!

[Daniel González]

Hi Elena,

The correct scope is  "https://www.googleapis.com/auth/ddmconversions" 

It is not sufficient to use only

"https://www.googleapis.com/auth/dfatrafficking"

Try to use both permissions. Passing manually  a list scopes  to create the credential.

The profile has access to perform this action, but  when you're doing an api call on behalf an user (oauth), you're requesting to do action based on the current scope that you give, not the permissions that this profile has.


Regards

--
You received this message because you are subscribed to the Google Groups "Google's DoubleClick Campaign Manager API Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-doubleclick-for-ad...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-doubleclick-for-advertisers-api/f709e80b-dd07-45bc-aa4e-d535840ca0fcn%40googlegroups.com.

--

Daniel González 

 Developer Dynamo.Video 

skype [dan...@dynamo.video]

[ Calle Sant Quintí 47-53, Entrl 5ª - 08041 Barcelona ]

[DCM API (DoubleClick Campaign Mgr)]

Hi Daniel,

Thank you for actively providing your knowledge to the community. 

@Elena,

I agree with what Daniel mentioned. The correct scope is "https://www.googleapis.com/auth/ddmconversions". 

Feel free to get back to us if you still getting a permission error after updating the scope.

Regards,

Teejay Wennie Pimentel DCM API Team

ref:_00D1U1174p._5004Q2HyGtD:ref

[ELENA LOZANO BUSTILLO]

Thank you very much for your replies!

 

whether I put permission  DDMCONVERSIONS or if I put both (DFATRAFFICKING and DDMCONVERSIONS, :

 

InputStream credentials= StorageUtils.getFileAsInputStream(“MY_JSON”);

       GoogleCredential credential = GoogleCredential.fromStream(credentials)        .createScoped(ImmutableSet.of(DfareportingScopes.DFATRAFFICKING))                           .createScoped(ImmutableSet.of(DfareportingScopes.DDMCONVERSIONS));

I got the same error:

 

{

  "code" : 403,

  "errors" : [ {

    "domain" : "global",

    "message" : "Insufficient Permission",

    "reason" : "insufficientPermissions"

  } ],

  "message" : "Request had insufficient authentication scopes.",

  "status" : "PERMISSION_DENIED"

}

What could be the problem?

Thanks again!!

---

Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição

[DCM API (DoubleClick Campaign Mgr)]

Hi there,

Could you please check the scope of your token. You will need to use your refresh token to get a new access token, and then append the access token to the end of URL:  https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=
This will take you to a page with info about the access token, including its associated scopes. You will get the structure as below:

{
"issued_to": "#####",
"audience": "#####",
"scope": "#####",
"expires_in": #####,
"access_type": "offline"
}

If you are using the correct scope to make a conversion batchInsert call, then scope in the above structure should include  'https://www.googleapis.com/auth/ddmconversions'. More information regarding this can be found here.

[ELENA LOZANO BUSTILLO]

Thanks again for your help!!

 

I’m still with problems ☹

 

If I assign scope DFAREPORTING to my credential (credential.createScoped(OAUTH_SCOPES);) and make the following call (UserProfileList profiles = reporting.userProfiles().list().execute();), when checking the token (credential.getAccessToken()) as you indicate in your email, (:  https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=) it returns

 

{

  "issued_to": "118238380506593108484",

  "audience": "118238380506593108484",

  "scope": "https://www.googleapis.com/auth/dfareporting",

  "expires_in": 3566,

  "access_type": "online"

}

 

On the other hand, if I assign scope DDMCONVERSIONS to my credential (credential.createScoped(OAUTH_SCOPES);)  and make the following call, (FloodlightActivity floodlightActivity = reporting.floodlightActivities().get(profileId, floodlightActivityId).execute();) it throws an exception

 

403 Forbidden

{

  "code" : 403,

  "errors" : [ {

    "domain" : "global",

    "message" : "Insufficient Permission",

    "reason" : "insufficientPermissions"

  } ],

  "message" : "Request had insufficient authentication scopes.",

  "status" : "PERMISSION_DENIED"

}

 

 

so I can't get the token to do the check you indicate.

 

Thanks one more time!

 

De: DCM API (DoubleClick Campaign Mgr) <dcmapifor...@gmail.com>
Enviado el: viernes, 28 de mayo de 2021 12:01
Para: ELENA LOZANO BUSTILLO <elena.loza...@telefonica.com>
CC: dan...@dynamo.video; google-doubleclick-...@googlegroups.com
Asunto: RE: Upload Offline Conversions (Java) : 403 Error

 

Hi there,

[Daniel González]

Hi Elena,

It seems that the refresh token doesn't have the scope of the DDMConversion, if you need an operation that needs both permissions , for instance to check to floodlight activities, and immediately after this you need to add  the offline conversion on the correct floodlight activity, I recommend to use both scopes. If there is a gap time between these two operations I recommend to use two token one with the scope, DDMConversion,  to  insert the offline conversion, and other DfaReporting  the first to check the floodlight activities .
Also to troubleshoot correctly  credential.get(), needs to be before any call.
So:
 1- Please make sure that credential.get gives you both scopes. Or that the two tokens have the correct scopes.
 2- Do the calls that you need. 
Regards

[DCM API (DoubleClick Campaign Mgr)]

Hi Elena,

 

I work with teejay. Allow me to assist you.

 

@Daniel Thank you for sharing your insights.

 

@Elena You need to have both scopes DFAReporting and DDMConversion in creating your credential in order to fulfill this action. Reading from the thread, I can see that in your previous mails you tried to passed both DDMConversion and DFATrafficking scopes instead of DFAReporting and DDMConversion, hence you are getting the permission denied error.

 

And from your latest message you are only passing the DFAReporting scope to your credential. Upon updating this, you should be able to upload offline conversions successfully.

Regards,

Michael Angelo Legaspi DCM API Team

ref:_00D1U1174p._5004Q2HyGtD:ref

[ELENA LOZANO BUSTILLO]

Thank you very much both of you!!  With your suggestions, now it’s working!!!!!

 

De: DCM API (DoubleClick Campaign Mgr) <dcmapifor...@gmail.com>
Enviado el: martes, 1 de junio de 2021 6:10
Para: ELENA LOZANO BUSTILLO <elena.loza...@telefonica.com>
CC: dan...@dynamo.video; google-doubleclick-...@googlegroups.com
Asunto: RE: Upload Offline Conversions (Java) : 403 Error

 

Hi Elena,