Google Directory API - 403 [Not Authorized to access this resource/api] on one machine, works on another

Question

I've been testing my authorization code and suddenly I started to get:

Not Authorized to access this resource/api [403]
Errors [
    Message[Not Authorized to access this resource/api] Location[ - ] Reason[forbidden] Domain[global]
]

I scratched my head and tried a few things but I didn't think I'd changed anything. Eventually I tried running it on a different machine. It worked without error.

I'm using v1.6 of the Google Directory API .NET Client. I've been working on this for a while. I had service authorization working and was working on client authorization when I experienced the issue. I'm currently getting the same error when I try authorizing with service creds. I'm not currently in a position to check if that process still works on the other machine.

Any ideas?

EDIT

I'm using the same ClientId on the two machines.

Answer 1

Someone had taken my account out of the Admin role. The reason it worked on the other machine was I'd logged in with a different admin account that hadn't been 'house-kept'. The names only differ by one character and I hadn't noticed.

Answer 2

I came across this post when receiving the same error. I am not in an Admin role, but figured I should be able to see the basic User Profile since I can access it from Contacts. After a little more research I came across this good piece of information: https://developers.google.com/admin-sdk/directory/v1/guides/manage-users#retrieve_users_non_admin

In a nutshell, set viewType parameter to domain_public

Here's what that looks like in C#

    var getRequest = directoryService.Users.Get(googleId);
    getRequest.ViewType = UsersResource.GetRequest.ViewTypeEnum.DomainPublic;  
    User directoryUser = getRequest.Execute();

Answer 3

I was getting a 403 error as well. I resolved it by correcting the permissions. I had the project setup into Google under xyz@company.com:

1. I had to login as our super user into Gmail
2. search for user xyz
3. I selected the user, then pressed Show more
4. I clicked on 0 Admin roles and privileges
5. enabled "User Management" since I was trying to pull a list of users

And the error went away.

Answer 4

I came across this thread but none of the answers helped me... as it turns out I made a typo in the domain name of the group I was looking up... 🤦‍♂️

GET https://admin.googleapis.com/admin/directory/v1/groups/gruop@sub.example.com
                                                             ^^
=> Error 404 "Resource Not Found: groupKey"

GET https://admin.googleapis.com/admin/directory/v1/groups/group@sbu.example.com
                                                                  ^^
=> Error 403 "Not Authorized to access this resource/api"

So if you get a 403 error, check to make sure it's not just a 404 error in disguise 😉