Webmasters API User does not have sufficient permission for site

Question

I use google-api-php-client library to access webmaster tools data. When I wanted to list sitemaps, it appeared Fatal error: Uncaught exception 'Google_Service_Exception'(403) User does not have sufficient permission for site. See also: https://support.google.com/webmasters/answer/2451999.' I add the service account email address as a restrict user for my site, but error still exists.

Finally I find the answer: A service account is not like a regular Google account. You cannot use it to access specific resources even if you give that specific address "access" to it. See here for the different ways you can authorize your requests to the Webmaster API.

Lentic

I have same problem using nodejs - on a piece of code that used to work – Nertie

Answer 1

For me the problem was not the actual permission, but the way the domain name is passed.

You should prefix your domain with sc-domain:: sc-domain:yourdomain.com. Passing just 'yourdomain.com' without the sc-domain: prefix will result in the error User does not have sufficient permission for site yourdomain.com.

Here is my Node.js example, but the same goes for PHP:

import {JWT} from 'google-auth-library';

const client = new JWT(
    null,
    'service-account.json',
    null,
    ['https://www.googleapis.com/auth/webmasters.readonly'],
);
const res = await client.request({
    url: 'https://www.googleapis.com/webmasters/v3/sites/sc-domain:yourdomain.com/searchAnalytics/query',
    method: 'POST',
    data: {
        "startDate": "2020-04-01",
        "endDate": "2020-05-01",
        "dimensions": ["country", "device"]
    }
});

console.log(res.data);

• Make sure you added the service-account email as user in search console: https://search.google.com/search-console/users

Kinchinjunga

Freaking unbelievable. I had the exact same issue and this solves it. However, for other domains it works with 'http://' plus the domain and not 'sc-domain:'. It seems that if the Google Search Console property is old-style, with the http[s]://[www] prefix, you need to use the url, while if it is a "domain" property (the kid where the protocols and subdomains are all unified and that you verify ownership via DNS), then you need to use this solution. How did you find this and where is it documented? – Architectural

@Architectural Not sure, I think I saw some sample code somewhere which used this notation. Pretty sure it was NOT the docs... – Kinchinjunga

@Architectural i found the documentation about that, developers.google.com/webmaster-tools/… – Synergistic

Great catch. They do not list it in their Python docs – Illinium

sc-domain? Seriously? Argghhh!! – Alleyn

Martijn I love you. Been banging my head off this wall for 1 day and didn't see that in docs. Thank you – Carillon

Answer 2

A service account is not like a regular Google account. You cannot use it to access specific resources even if you give that specific address "access" to it.

You need to manage the service permissions via Webmaster Admin. Add your service account

[email protected]

there.

Latoyalatoye

Thanks. I don't know how I've missed this but that did the trick. I initially thought it would be enough to "just" have permissions with the principal user that the service account is associated with but evidently that wasn't enough. So thanks again for this tip! – Santalaceous

Answer 3

The solution suggested by @MartijnvdB won't work. But finally, I got one that works for me:

URL should be composed as follows: sc-domain:domain.com

Electric

Answer 4

If anyone is reading this in 2023: @MartijnvdB's solution is still valid, use sc-domain:domain.com for domain properties, or https://www.myurl.com for non-domain properties. Documentation: https://developers.google.com/webmaster-tools/v1/searchanalytics/query#parameters (see siteUrl).

Michelmichelangelo