403 error on projects.locations.productSets.create

[timdev75017]

Hi,

I am unable to use the projects.locations.productSets.create method via the API Explorer. I receive the following http response:

{
"error": {
"code": 403,
"message": "Permission denied.",
"status": "PERMISSION_DENIED"
}
}

Here is the associated CURL command:

curl --request POST \
'https://vision.googleapis.com/v1/projects/my-project-id/locations/europe-west1/productSets' \
--header 'Authorization: Bearer [YOUR_ACCESS_TOKEN]' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data '{"displayName":"testnamedisplay"}' \
--compressed

For authentication, I have tried using Google OAuth 2.0, an API Key, and both together. Each attempt led to the same 403 error.

Regarding the account I’m using, it has the following IAM roles for the specified project (my-project-id) :

• AI Platform Admin

• Owner

• VisionAI Admin

• VisionAI Editor

The VisionAI API is properly enabled. For example, I receive a 200 response when using the images.annotate method.

I have also tried other regions, such as us-west1, but I get the same result.

Is there a way to identify the root cause of this authentication error? If not, has anyone encountered this issue and could offer suggestions to help resolve it?

Thanks a lot for your help !

[MarvinLlamas]

Hi @timdev75017,

Welcome to the Google Cloud Community!

The error that you encountered is a 403 "Permission Denied" issue when using the projects.locations.productSets.create method of the Google Cloud Vision API.

Here are the potential ways that might help with your use case:

• Double-Check the Required Permissions: Even with your VisionAI Admin or Editor roles, you need to verify the precise permissions required for projects.locations.productSets.create. Your high-level roles might not always grant you the specific, granular permissions necessary for certain actions.
• Correctly Setting Project ID: Double check that when you assigned the roles, you didn't assign them just to an individual resource and not the project. Assign them on the project level.
• Service Account or User Account: Ensure that if you're using a service account, it is correctly linked to the project and has the necessary roles assigned to it.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

[timdev75017]

Hi @MarvinLlamas ,

Thanks a lot for your answer. 

• Double-Check the Required Permissions: Where can I find the list of the required permissions to use a specific API ?
• Correctly Setting Project ID: I've been setting permissions through the IAM interface, with the correct project selected.
• Service Account or User Account: All good also, I'm using my personal account with the API Explorer, and setting permissions on the same account.
  

My guess is that I missed a necessary permission as you suggest, maybe something about storage. Where can I find a list of required permissions ? 

Thanks