Using the GA API with a particular segment, the authenticated token is from an admin who created the segment. The segment was shared with the permissions for "Collaborators and I can apply/edit Segment in this View"
I've verified the Property ID, View ID, and Segment ID from the interface with the API call. The GA API returns "User does not have sufficient permissions for this advanced segment."
The user created the segment and shared it, so I'm at a bit of a loss as to why I get this error response. Any help would be much appreciated. Thanks!
#Ash has the correct answer but here is a more detailed response:
The user that created the Segment must open complete the following in Google Analytics:
Open the segment panel and select 'Custom', then click 'Edit' for the segment you would like to share.
Then click 'Change' in the top right corner.
You can now select the option allowing collaborators to apply and edit the segment within the view.
Save your changes.
This will allow you to query the custom segment using a service API.
1) A segment in Google Analytics belongs to the user who created it and only that user has access to the segment.
2) A service account will not have access to any of the saved advanced segments. For API requests you could try using dynamic segments instead.
So, a User has saved segments and those segments can be applied to any request for views (profiles) that the User has access to.
Example:
Assuming User A creates/saves a segment and User B also has saved segments and your application is authorized to access User A and B's Analytics account (i.e. they give permission to your App to access their data). The App would be able to retrieve the IDs of the saved segments for both users but you can't apply User A's segment ID to a request for User B's data. For that to work, User A would need to have access to User B's view (profile) to begin with.
I was facing same issue and the error was:
HttpError 403 when requesting https://analyticsreporting.googleapis.com/v4/reports:batchGet?alt=json returned
"User does not have sufficient permissions for this advanced segment."
Creating shared Segment resolved above issue.
Credits and more info: Google groups
Related
We have Page-Access-Token with all the permissions available (just for testing purposes), we also have a Business System User token and this is the steps we are trying to do
1: We connect our business to the facebook page as an agency using this api call
/me/agencies?access_token=${PAGE_ACCESS_TOKEN}&business=${BUSINESS_ID}&permitted_tasks=['ADVERTISE']
we will become partners with the page successfully.
2: we try to assign our business System user to the page that we just connected our business to using this api call
/me/assigned_users?business=${BUSINESS_ID}&user=${SYSTEM_USER_ID}&access_token=${PAGE_ACCESS_TOKEN}
but this request will fails and we get this response
error: {
message: 'Invalid parameter',
type: 'OAuthException',
code: 100,
error_subcode: 1752100,
is_transient: false,
error_user_title: 'User is not Business Scoped',
error_user_msg: 'The user ID provided is not business scoped. Please provide a business or a system user ID',
fbtrace_id: 'AMSzq06ES6nymFDFD31JWAk'
}
we know that it's possible for the System User to be assigned to the page because you can do that in the businees.facebook.com but we want to do it using graph api
Things we confirmed
The System User ID and Business ID are both correct
The Business is already connected to the page as we mentioned in the step 1, and we confirmed that by looking at Page Roles from the page settings we saw our page as an agency for the page
Things we saw that were interesting
if the page owner have role in the business the second api call would end up successfully and the system user will be assigned to the page
So, How can we assign our system user to the pages that connect to our business
Found a workaround, I created a Business Asset Group, added the system user to this group in the business.facebook.com then through Graph Api I could add the page to this group and the system user now have control over the page just like how I want it.
I'v built an app that creates ads using the marketing API. When it creates the adset it sets a specific pixel and a page view event.
All our users get the correct pixel and the correct event except for one user.
Here is the object from the post request that is being sent to Facebook where we can see that they are equal
User one
"promoted_object":"{\"pixel_id\":xxxxxxxxxx63,\"custom_event_type\":\"CONTENT_VIEW\",\"pixel_rule\":\"{\\\"event\\\":{\\\"eq\\\":\\\"PageView\\\"}}\"
User two
"promoted_object":"{\"pixel_id\":xxxxxxxxxx63,\"custom_event_type\":\"CONTENT_VIEW\",\"pixel_rule\":\"{\\\"event\\\":{\\\"eq\\\":\\\"PageView\\\"}}\"
Both get the correct pixel with the correct id but one gets no conversion event, and say Missing conversion event.
Both ad accounts have full access to the pixel under the business settings in ads manager.
Here is an image that describes the issue.
Anyone have any ideas here?
make sure the conversion event is defined in that account.
The conversion event is usually set on Campaign Level and supplied when you create a campaign via API.
As you're trying to use a custom conversion it might be that you've created it for one account but didn't create it for another. That's why you don't see it in you campaign setup view. You can create it via API as described here:
Custom Conversion API
Or just do it via Business Manager and use it afterward when creating you campaigns via API or manually.
It's definitely not a request that fails in this case but a proper account configuration.
I have been experimenting with the REST API using my logged in user account's token to then make PUT requests on my user record to update some custom attributes.
In order to get to this work I had to grant my user account the manage-users role in Keycloak, prior to this I was getting forbidden responses back.
I can now make the PUT request successfully, and after logging out and logging back in I can see the updated attributes I set in my PUT request.
But I have now allowed my user to be able to manage all users in my realm, which I dont want to allow.
Instead I only want to be able to update my own account details.
I know the user can view their own profile and make changes on the Keycloak provided screens. But for certain custom attributes I want to be able to do this from the client side application they are logged in to, so using the REST API but not granting them a role that could allow them to update other users details.
Is this possible?
According to the User section Keycloak's Admin REST API, this is not possible.
One solution would be for your client app to send the update request to a backend. The backend will verify that the update request is legit (aka the JWT is verified and the update does apply to the user requesting the change).
Another solution would be to theme the User Account Service's screens to add input fields for your custom attributes, as the documentation says that:
This screen can be extended to allow the user to manage additional attributes. See the Server Developer Guide for more details.
The second option seems the more secure. I hope that helps.
This seems to be possible with the Account Management API.
Unfortunately, I didn't find any official documentation about that. However, there's an example in Keycloak that demonstrates how to do it.
okta when configured, automatically creates box accounts for new users added to okta's AD.
Is there any way to get information from box if the account created by okta is successful or not? I am referring only API calls.
If I understand correctly, the way Okta is configured on your side is that when new users are created in Okta, they are assigned to and created in Box as well (probably using group assignment to Box?)
If that is the case and you want to make sure that users are created in a downstream app Box, you can use Okta's event API to confirm.
Please see this link: http://developer.okta.com/docs/api/resources/events.html#application-user-management
The event type (action.objectType) you are looking for is: app.user_management.push_new_user
You can make following call to get the user created in Box:
GET /api/v1/events?filter=published gt "2016-11-17T00:00:00.000Z" and action.objectType eq "app.user_management.push_new_user" and targets[1].displayName eq "<Box_App_Name>"
Where <Box_App_Name> is the displayName of the app under targets as it appears. Before you run the call above, you may need to confirm the displayName of Box or alternatively, use the id (better than displayName) from targets array.
Using Google Analytics API to retrieve 20+ Profiles' data so i can combine all of them into one set of data for analysis. (separate profiles are for different domains that all have identical content)
I am using a Custom Segment on each Profile to remove referral spam. I have given the Custom Segments the same name eg 'referrer spam'.
So I want to use these Custom Segments when retrieving records with the API. However have run into a challenge.
I thought I could loop through the segments and get each Profile's Id by the Custom Segment name eg 'referrer spam'. The first thing I did was loop through the Segments to see what it would give me. So I did the following:
# Authenticate and construct service.
service = get_service('analytics', 'v3', scope, key_file_location,
service_account_email)
segments = service.management().segments().list().execute()
for segment in segments.get('items', []):
print 'Segment ID ' + segment.get('id') + " - " + segment.get('name')
But this doesn't retrieve the Custom Segments, only the 'standard' Google segments eg things like:
Segment ID -1 - All Sessions
Segment ID -2 - New Users
Segment ID -3 - Returning Users
Segment ID -4 - Paid Traffic
Segment ID -5 - Organic Traffic
Segment ID -6 - Search Traffic
Segment ID -7 - Direct Traffic
Segment ID -8 - Referral Traffic
Segment ID -9 - Sessions with Conversions
Segment ID -10 - Sessions with Transactions
etc etc
So it looks like I am unable to access the Custom Segments.
I believe this has something to do with fact that I am using a Service Account and it doesn't have permissions to access the Custom Segments?
I have given the API generated developer gmail address/user read permission to all of the Profiles. I guess that isn't sufficient to get the Custom Segments.
Am I missing something? Is there a way to get Custom Segment using a Service Account? Do I need to authenticate with other than Service Account?
I found an easy way to get custom segments details from api.
First, you need to have user management access, probably an administrator can easily do that.
Manage Segments#Set Segment availability
Visit this link and go to 'Set Segment availability' section in there.
Apply 'Collaborate permission' option as shown in the link.
After applying permission, just from your service account and api run the same code as you mention in you question or follow the below link of code to list all segments details.
Listing a User's Segments
This time you will be able to get custom segment ids. I was trying to get the custom segment details since last 3-4 days. Hope it helps.
The answer is that the Analytics Core Reporting API doesn't have access to the custom segments. They can only be accessed by the Analytics Management API as referenced here:
Retrieve a user's Custom Segments to apply them to Core Reporting API queries.
https://developers.google.com/analytics/devguides/config/mgmt/v3/
So looks like I will have to make call to Analytics Management API first to get list of custom segments that I want, and then use that list in Analytics Core Reporting API call to get data for just those segments.
https://developers.google.com/analytics/devguides/reporting/core/v3/reference#segment
Alternatively, I can forget about using the custom segments and instead retrieve Session Hostname and Source in Analytics Core Reporting API call data, so that I can do same filter in the query or in report as my custom segment. Drawback is that the referral spam is about 80% + of Google Analytics data so I would be retrieving more data than i need on regular basis.