API Cloud Identity

[sofist]

Good morning,

I'm using the service account API to access cloud identity, I need scope = ['https://www.googleapis.com/auth/cloud-identity'] but I can't make any requests to the cloud APIs, I need to bring endpoint information from my google workspace, can anyone help? I get the return:

Error listing user endpoints: <HttpError 403 when requesting https://cloudidentity.googleapis.com/v1/devices?alt=json returned "The caller does not have permission". Details: "The caller does not have permission">

[Willbin · Accepted solution]

Hello @sofist,

Welcome to Google Cloud Community!

It means that the service account API you are using to access Cloud Identity does not have the necessary permissions. 

Check the IAM roles assigned to your service account. Make sure that your service account has been assigned a role that includes the required permissions for accessing the Cloud Identity API. To gain access in Cloud Identity functionality, you need to add these roles. roles/identity.platformAdmin or roles/identity.organizationViewer.

To Grant IAM role:

---

1. In the Google Cloud console, go to the IAM page.

2. Select your new project.

3. Click person_add Grant access.

4. Enter the email address of a principal.

5. From the Select a role drop-down menu, search for the role you want to add

6. Click Save.

7. Verify that the principal and the corresponding role are listed in the IAM page.

---

On the other hand, if you want to authenticate a service account with domain-wide privileges so it can manage Google groups on behalf of admins, you should authenticate as a service account. See Using OAuth 2.0 for server to server applications

[Jegadheesan]

I have added above mentioned roles. But still facing the same issues ('Error: HTTP 403 - { "error": { "code": 403, "message": "The caller does not have permission", "status": "PERMISSION_DENIED" }}')

[Mugenor]

Having the same issue.