Unable to use Document AI API in a C# app

[cyrildavydov_42]

Hi!

For some reason, I cannot enable Document AI API in my app.

I am trying to utilize the image recognition function in this API. Following the instructions for Setting up Application Default Credentials, I generated a service account and a key for said account. Then I fed this key to my C# application as described in Document AI client libraries (C# section), but in the end I receive an error:

Detail=\"Permission 'documentai.processors.processOnline' denied on resource '//documentai.googleapis.com/projects/*my_project_ID*/locations/us/processors/*my_processor_ID*:process' (or it may not exist).\")",

Take note, that I redacted my Project and Processor ID in the error message above.

I've checked all permissions and IAM settings, and it appears to be correct.

I've done a quick search on this forum and looked elsewhere but weren't able to find a concrete answer. Any help or pointing in the general vicinity of the correct answer are greatly appreciated.

[ruthseki]

Hi @cyrildavydov_42,

Welcome to Google Cloud Community!

I understand that you are encountering a permissions issue with the Document AI API.

I recommend visiting this page for guidance on all the required setup steps to start using Document AI.

Additionally, here are a few workarounds that you may try:

1. Enable the API: Ensure that the Document AI API is enabled for your project. Sometimes, it might take a few minutes for the changes to propagate.

2. Check Service Account Permissions: Verify that the service account you're using has the necessary permissions. Specifically, it should have the “documentai.processors.processOnline” permission. You can assign this permission through the IAM settings in the Google Cloud Console. Make sure also that you have a “Document AI API User” IAM role. 

3. Set Environment Variable: Make sure the “GOOGLE_APPLICATION_CREDENTIALS” environment variable is correctly set to point to your service account key JSON file. This variable must be accessible in the context where your application is running.

4. API Key: Ensure that your request includes a valid API key if required. Sometimes, missing or incorrect API keys can lead to permission errors.

5. Resource Existence: Double-check that the processor ID and project ID you are using in your request are correct and that the processor exists in the specified location.

It might be helpful also to review the detailed error messages and logs for more insights. You can refer to the Document AI error messages documentation for more troubleshooting tips.

I hope the above information is helpful.

[cyrildavydov_42 · Accepted solution]

Thank you for the prompt answer!

2. Check Service Account Permissions solved my problem. I did it all, except №2! Since I usually limit API keys and service account based on domain or IP, I didn't even pay any attention to the fact that service account itself is also required to have proper roles in IAM.

Document AI error messages documentation was also very helpful in troubleshooting.