Google Analytics API: "User does not have sufficient permissions for this account."

Question

I'm writing a Ruby app that accesses the Google Analytics API to pull down some experiment information.

The app connects and authenticates using a Google Service Account via the following function:

def connect
  ...
  @@client = Google::APIClient.new(:application_name => 'My Service App', 
                                    :application_version => '1.0.0')
  key_file = Rails.root.join('config', 'privatekey.p12').to_s
  key_secret = 'somesecret'
  key = Google::APIClient::PKCS12.load_key(key_file, key_secret)
  asserter = Google::APIClient::JWTAsserter.new(
    SECRETS[:google_service_account_email],
    ['https://www.googleapis.com/auth/yt-analytics.readonly',
     'https://www.googleapis.com/auth/analytics.readonly'
    ],
    key
  )
  @@client.authorization = asserter.authorize()
  ...
end

...which authenticates and discovers both APIs without issue.

Using the client against the YouTube Analytics API works without issue. Using the same exact account to access the Analytics API via...

response = @@client.execute({
  # 'analytics is the API object retrieved via discover_api()
  :api_method => analytics.management.experiments.list, 
  :parameters => {
    'accountId' => 'AAAAAAAA',
    'profileId' => 'PPPPPPPP',
    'webPropertyId' => 'UA-WWWWWWWW-#'
  }
})

Results in a 403 error response:

{"domain":"global","reason":"insufficientPermissions","message":"User does not have sufficient permissions for this account."}

In regards to authorization, I have double-checked the account [email protected]:

• Has full permissions to the Google Analytics web interface. I logged in using the [email protected] account and was able to view the same Experiments I attempted to list.
• Has enabled the Analytics API. Within the API Console, I confirmed in the Services section that the Analytics API item is switch to ON. (Just like YouTube Analytics is.)
• I am using the appropriate AccountID, ProfileID, and WebPropertyID values. Copied directly from the Google Analytics web interface.

Given that the service account can access at least one API (YouTube Analytics), and the associated account ([email protected]) can access the Analytics web interface, there seems to be something wrong with the service account accessing the Analytics API in particular.

Any ideas?

Similar topics:

• “Not sufficient permissions” google analytics API service account (NOTE: This error is slightly different than mine)
• Analytics blog post, check comments section for 'permissions'

Solution 1

Make sure you give the service account email (something like [email protected]) permissions to read/write from your GA view.

Admin > View > User Management > "Add permissions for:"

Solution 2

Pick the right id!

In my case I was using the right credentials (account id, account secret -> authorization_code -> access_token) AND had the email permissions set up right but I was using the account id on the Admin > Account settings page and simply adding ga: to the front.

The id you actually need is the table id! (or that's the one that worked for me at least since most people here are mentioning the account id, which didn't work for me.). You can find that one here: https://ga-dev-tools.appspot.com/account-explorer/

And then you can query as

service.get_ga_data(TABLE_ID,'2017-03-25','2017-03-25','ga:users,ga:pageviews')

I found this API to be badly documented overall and the UI was unclear. But maybe that's just me.

Solution 3

If you still see this message after you added your developer email to analytic user.

You may need to add scope to the object, before new Google_Service_Analytics($client);

$client->setScopes("https://www.googleapis.com/auth/plus.login");

I spent whole day trying to solve this!

Solution 4

I also had to go to the developer console and enable the API in order to make it work. Go to the developer console and select your project and enable the API(s) you want to use.

Solution 5

Even after adding the email to the account level in analytics I still had the same permission problem but the following suggestion helped but didn't solve it:

$client->setScopes("https://www.googleapis.com/auth/plus.login");

That didn't work for me but this did:

$client->setScopes("https://www.googleapis.com/auth/analytics");

https:// is now required to authenticate.

View more solutions

Comments

[Goose]

did you give permissions to the service account on your actual GA profile? Admin > View > User Management > "Add permissions for:"

[David Elner]

The [email protected] account has full permissions. However, your comment did prompt me to add the actual service account email as well (i.e. [email protected]), which seems to resolve the problem. If you'd like to put this in the form of an answer, I'd be happy to give you credit.

[andygeers]

possible duplicate of Analytics Google API Error 403: "User does not have any Google Analytics Account"

[David Elner]

@andygeers This one has a different error message, is written in Ruby, and is already 6 months old... I don't think marking this as a 'duplicate' will help anyone at this point. Plus, even if it were a duplicate, leaving this one open will allow more people from Google to reach their answer (via SEO.)

[andygeers]

@DavidElner Ok, the solution was more or less the same in both cases, but seeing this question made me give up whereas the answer to the other question had an extra detail that ultimately sorted it for me. So I just figured that the existence of this question actually made it harder for me to find the answer.

[andygeers]

@DavidElner One final clarification: I actually got both error messages simultaneously, but maybe that's not the case for everyone

[David Elner]

@andygeers I respectfully disagree: my question has far more detail, and links to other resources, while the other answer only has "I followed Google's instructions." Despite the answer being the same, the questions are different; users won't find either the same way, so this one provides additional coverage.

[andygeers]

@DavidElner No problems, I've updated the answer with the extra details

[Cadab]

I had this same problem, the issue was i was using the profileID for the whole account. I then went into my account on the web, and pulled the the real id for the site from the URL. It's the ID towards the end, e.g. realtime/rt-overview/XXXXXXXXXXXXXXpYOURIDHERE/. Another way is to use the code, "ga.Service.Management.Profiles.List("~all", "~all").Execute();" to list all the id's for your account.

[andygeers]

One extra gotcha: make sure you do this at the "Property" level and not at the "View" level (Google Analytics's admin interface is a little confusing at this point)

[tugberk]

@andygeers thanks for this little tip! very helpful indeed :)

[Andrea Moro]

Would you mind posting a gist with your code? What is your client object? I have the scope set, but with something different and I can make basic quries ...

[Chris]

So I did this and it's still not working for me. Any other suggestions?

[Chris]

No kidding, if you're accessing Analytics data you need to add the analytics scope.

[Ignacio Chiazzo]

where is this? I didn't find the admin section

[pheeper]

Yes! This was the problem I had as well. No where did I find "table_ID" mentioned in the four tutorials I looked through. I only figured it out after reading this post and using the URL listed above.

[Gruffy]

Yes! I had permissions on the Service account, the Analytics account, set the scope within my PHP code, AND within my JS, I knew there was another button I had to push somewhere.

[Greconomist]

I am using the googleAnalyticsR CRAN package, had the same issue as stated by the op. Seems like I was the accountId instead of the viewId. +1 from me

[sergio]

Even at the "Property" level it did not work for me. But at the "Account" level it was ok.

[factorypolaris]

If you connecting using a service account, the scope: googleapis.com/auth/analytics is required. However when using OAuth 2.0 the scope required is: googleapis.com/auth/plus.login. At least this has been my experience on node.js using A global service account.

[zar3bski]

similar right issues on Google Search Console (Domain VS urls). You saved my day

[Caio Mar]

Here is [Google Analytics API Reference] (developers.google.com/analytics/devguides/reporting/core/v3‌​/…) -- it took me a while to find it and it shows all URLs and params available to us.

[hatirlatici]

Still helpful, Thank you!

[vijay]

i was missing @developer.gserviceaccount.com account email