Unauthorized (401) error

[avd ams-dsi]

Hi DFP forum,

i want to consume web service NetworkService operation getAllNetworks but the system returns me an unauthorized (401) error.

I don't use DFP librairies (i can't), i work directly in HTTP.

The authorization bearer is placed in HTTP header.

Here is the request i'm sending to URL https://www.google.com/apis/ads/publisher/v201608 :

<?xml version="1.0" encoding="ISO-8859-1"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:v20="https://www.google.com/apis/ads/publisher/v201608">
<soapenv:Header>
<v20:RequestHeader>
<v20:applicationName>TEST API</v20:applicationName>
</v20:RequestHeader>
</soapenv:Header>
<soapenv:Body>
<v20:getAllNetworks/>
</soapenv:Body>
</soapenv:Envelope>

What's wrong ? 

Thanks for any help.

Eric

[Olivier Lebon]

Hi Eric,

I also had to bypass the SDK's in the past and build my own HTTP requests - not always easy! If the bearer token is passed as expected in as a HTTP header, you might want to check that your network code is also present in the payload (I have added it a dummy code just before the application name tag):

<?xml version="1.0" encoding="ISO-8859-1"?>

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:v20="https://www.google.com/apis/ads/publisher/v201608">

<soapenv:Header>

<v20:RequestHeader>

<v20:networkCode>123</v20:networkCode>

<v20:applicationName>TEST API</v20:applicationName>

</v20:RequestHeader>

</soapenv:Header>

<soapenv:Body>

<v20:getAllNetworks/>

</soapenv:Body>

</soapenv:Envelope>

Not sure if that will solve the problem but always worth a try :)

Oli

[avd ams-dsi]

Hi Olivier,

thanks for your response.

Normally in this API's call i don't need to pass networkCode because rightly i want to get the list of all Network objects to which the current login has access. But i tried with a networkCode and it don't work.

Attached to this message, my http header, hoping it helps.

Thanks :) :)

[Olivier Lebon]

Hi Eric,

that makes sense. How do you generate the bearer token? Is it hard-coded in your code or is it issued by the server after authentication?

[Vincent Racaza (DFP API Team)]

Hi Eric,

Since you are not using one of our client libraries, please check the correct SOAP request below for the getAllNetworks method of NetworkService so you can simulate it in your end:

<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

    <soapenv:Header>

        <ns1:RequestHeader xmlns:ns1="https://www.google.com/apis/ads/publisher/v201608" soapenv:mustUnderstand="0">

            <ns1:applicationName>My Application Name(DfpApi-Java, Dfp-Axis/2.18.0, Common-Java/2.18.0, Axis/1.4, Java/1.8.0_102-google-v7, jars)</ns1:applicationName>

        </ns1:RequestHeader>

    </soapenv:Header>

    <soapenv:Body>

        <getAllNetworks xmlns="https://www.google.com/apis/ads/publisher/v201608"/>

    </soapenv:Body>

</soapenv:Envelope>

Thanks,

VIncent Racaza, DFP API Team

[avd ams-dsi]

Hi Vincent and Olivier,

for Olivier : i use the service account flow, i send a HTTP POST request to URL "https://www.googleapis.com/oauth2/v4/token", with the JWT that i previously created, and i get a good access token from Google.

for Vincent : just one question... Why when i use SOAP UI to visualize the SOAP request, i can see the characters 'v20' for example '<v20:RequestHeader>' instead of '<ns1:RequestHeader' as you suggest ?

Thanks a lot.

Eric

[Vincent Racaza (DFP API Team)]

Hi Eric,

I can't replicate the 'v20' in the SOAP request using our client libraries. The '<ns1:RequestHeader' is the correct one, so please use this instead. You may replace all instances of 'v20' to 'ns1'.

Thanks,

Vincent Racaza, DFP API Team

[avd ams-dsi]

Vincent, 

i made the changes but it don't work, i have the query below : 

<?xml version="1.0" encoding="utf-8"?>

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

 <soapenv:Header>

  <ns1:RequestHeader xmlns:ns1="https://www.google.com/apis/ads/publisher/v201608" soapenv:mustUnderstand="0">

   <ns1:applicationName>TEST API</ns1:applicationName>

  </ns1:RequestHeader>

 </soapenv:Header>

 <soapenv:Body>

  <getAllNetworks xmlns="https://www.google.com/apis/ads/publisher/v201608"/>

 </soapenv:Body>

</soapenv:Envelope>

Now the system returns the following error: 401 Unauthorized or 404 Not Found

I don't understand my mistake.

[Vincent Racaza (DFP API Team)]

Hi Eric,

The SOAP request that you sent for getAllNetworks method is already correct.

Since you are not using the client library, it is difficult to comment on why you are getting the 401 or 404 error. Normally, if you are using the client library and you received the 401 error, we check on your OAuth credential if it is set-up correctly in the property file and if the email address you are using is existing in your network. Also, we highly recommend you to use our client libraries.

Thanks,

Vincent Racaza, DFP API Team

[avd ams-dsi]

Vincent,

i can't use client library because my development environment is SAP. I followed DFP Google's official documentation which stipulates in my case, to know pure HTTP SOAP request.

For authentication i followed this official documentation : https://developers.google.com/doubleclick-publishers/docs/authentication

I did the following steps :

- Determine your authentication type : i choose Service account

- Create OAuth2 credentials : i created a service account on Google Developers Console Credentials Page and recovered the certificate P12 file

- Configure your DFP network : on Admin tab i add the service account previously created, API access is enabled

       -> question : what role should the service account have ? Administrator (DFP only) or full Administrator ?

- to implement authentication i implemented the OAuth2 service account flow : https://developers.google.com/identity/protocols/OAuth2ServiceAccount

I created the JWT and sent it to url https://www.googleapis.com/oauth2/v4/token, and i got my Token. 

Attached to this message i give you all data to check configuration.

Thanks

Eric

[Vincent Racaza (DFP API Team)]

Hi Eric,

You can have either the "Administrator (DFP only)" role or the full "Administrator" role. If you want an access to AdExchange also, then you can set it to full "Administrator" role. I have checked your service accounts, and they were set-up correctly in your network.

Since you are already done setting up your authentication, were you able to use other services aside from the NetworkService? Could you try running the get line item method and check if you can run it successfully?

Thanks,

Vincent Racaza, DFP API Team

[avd ams-dsi]

Hi Vincent,

thanks for your response, one question, what is the target URL for the web service call. I put the address 'https://www.google.com/apis/ads/publisher/v201608', is it correct ? Maybe it's my mistake...

To be clear, at what address should i send my SOAP request ? 

Thanks a lot.

[Vincent Racaza (DFP API Team)]

Hi Eric,

The web service endpoint is "https://ads.google.com/apis/ads/publisher/v201608/NetworkService" and the production WSDL for the NetworkService is "https://ads.google.com/apis/ads/publisher/v201608/NetworkService?wsdl". Are you still facing the issue in the get all networks method? Did you already try running the get line item method?

Thanks,

Vincent Racaza, DFP API Team

[avd ams-dsi]

Hi Vincent,

i changed the web service endpoint and now i get an HTTP 500 error (??).

The HTTP header is attached to this message. 

The SOAP request sent is : 

<?xml version="1.0" encoding="UTF-8"?>

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="https://www.google.com/apis/ads/publisher/v201608">

<soapenv:Header>

<ns1:RequestHeader>

<ns1:applicationName>TEST API</ns1:applicationName>

</ns1:RequestHeader>

</soapenv:Header>

<soapenv:Body>

<ns1:getAllNetworks/>

</soapenv:Body>

</soapenv:Envelope>

Same issue with CompanyService and method GetCompaniesByStatement.

The authorization: bearer have a size of 128 characters, it is correct ? 

Example : ya29.ElqlAz9dXiwvFWojI0NLLWKucCdVr122XvBmNG8nO26EuttqiEV73CinoBi2DvTDctTGbnR6TeG6OmP7WxnPtEyvx_ykc8G3lcgY9nu1l0W4Kv0mRLCdjwRS9MM

Thanks

[Chris Seeley (DFP API Team)]

How are you making the request? I copied your SOAP into a file and was able to make a successful curl request:

> curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" --data-binary "@/full/path/to/soap.xml" https://ads.google.com/apis/ads/publisher/v201608/NetworkService

Also, make sure that your header has capitalizes "Bearer". 

Thanks,

Chris Seeley, DFP API Team

[avd ams-dsi]

Hi Chris,

thanks for your response, please read my information above, everything is there, in addition there are screenshots.

Thanks.

Eric

[Chris Seeley (DFP API Team)]

Hi Eric,

Thanks - in both the screenshots and above posts the header you're passing doesn't have the correct capitalization for Bearer, which can cause issues. If changing that doesn't help, can you try making a request through curl instead of the SAP platform just to get as bare-bones as possible?

Thanks,

Chris Seeley, DFP API Team