IssueTracker

Hello,

Thank you for reaching out to us!

Sorry to inform you that the issue cannot be fixed. I will proceed to close this issue now. In case you want to report a new issue, please do not hesitate to create a new Issue Tracker thread describing your situation.

Hello.

I've been observing the same problem with Gmail api for the last few days. Same problem:

googleapiclient.errors.HttpError
<HttpError 403 when requesting https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest returned "The caller does not have permission">

I am using Cloud Function (python) and G-Suite service account (with token file). For the last 6 months everything was all right up till now.

The code is simple (python).

from googleapiclient.discovery import build
from google.auth.transport.requests import Request

def build_gmail_client():
    creds = pickle.loads(...) -- token file/data
    
    if not creds or not creds.valid:
        if creds and creds.expired and creds.refresh_token:
            creds.refresh(Request())
        else:
            print('Please, refresh manually') -- e.g. new token
            return None

        new_data = pickle.dumps(creds) -- save new token

    service = build('gmail', 'v1', credentials=creds, cache_discovery=False)

    return service

I can also confirm the same issue. Until today this error would go away after a few retries, but now it seems that it is failing constantly. I didn't change anything in the code and have setup service accounts and permissions correctly (everything worked until around June 25-30th)

Can we get an ETA for this issue as we are blocked from sending any emails via our internal tools

_SCOPES = ['https://www.googleapis.com/auth/gmail.readonly', 'https://www.googleapis.com/auth/gmail.send']
self.credentials = service_account.Credentials.from_service_account_file(credentials_file, scopes=GMail._SCOPES, subject=email)
self.service = build('gmail', 'v1', credentials=self.credentials)

where credentials_file is the json application credentials and email is the authorized user's email address (this call is meant for domain wide delegation)

Hi !

Thank you all for reporting this. I have filed this behaviour internally.

Could you share a screenshot with the full error message displayed? Does this behaviour persists across computers and users of your organization?

Best regards,

same issue here, been happening since July 2. even trying simple curl -v https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest returns 403

+1 - SEV1 in Prod

As a temporary workaround, the discovery document is available at:

https://raw.githubusercontent.com/googleapis/google-api-go-client/master/gmail/v1/gmail-api.json (this is a GitHub repository owned by Google for the Golang Google API library)

The Python client library can use this file stored locally rather than trying to retrieve it from googleapis.com:

discovery_doc = json.load('gmail-api.json')
gmail_service = googleapiclient.discovery.build_from_document(discovery_doc)

more details at:

http://googleapis.github.io/google-api-python-client/docs/epy/googleapiclient.discovery-module.html#build_from_document

there should be similar methods for other language libraries.

+1 - SEV1 in Prod

We get the following error for all our calls on https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest:

b'{\n  "error": {\n    "code": 403,\n    "message": "The caller does not have permission",\n    "status": "PERMISSION_DENIED"\n  }\n}\n'

Need the workaround for Ruby. Trying to apply this monkey patch but not working. Any thoughts? This is impacting few thousand of our users who are not able to send emails.

modulet Google
    class APIClient
      class Request
        def to_env(connection)
          method, uri, headers, body = self.to_http_request
  
          # <MonkeyPatch>
          if (uri_str == "https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest")
            uri_str = "https://raw.githubusercontent.com/googleapis/google-api-go-client/master/gmail/v1/gmail-api.json"
          end
          # </MonkeyPatch>
          
          http_request = connection.build_request(method) do |req|
            req.url(uri_str) # MonkeyPatch
            req.headers.update(headers)
            req.body = body
          end
  
          if self.authorization.respond_to?(:generate_authenticated_request)
            http_request = self.authorization.generate_authenticated_request(
              :request => http_request,
              :connection => connection
            )
          end
  
          request_env = http_request.to_env(connection)
        end
      end
    end
end

Hi everyone!

This issue has been resolved.

If you run into this behaviour again, please open a new Issue with the necessary details.

Best regards,

Hi there, can you confirm if you are still encountering this issue? Can you provide a code snippet that is resulting in you seeing this error?

We do still face the problem. We use google-api-javascript-client.

The code snippet is:

await gapi.client.init({
      clientId: process.env.OAUTH_CLIENT_ID,
      discoveryDocs: ['https://www.googleapis.com/discovery/v1/apis/translate/v2/rest'],
      scope: 'profile email',
      ux_mode: 'redirect',
      redirect_uri: `${window.location.origin}/authCallback`,
    });

The request that fails:

GET https://content.googleapis.com/discovery/v1/apis/translate/v2/rest?pp=0&fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid

The error we get:

{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}

We do still have the same issue for https://www.googleapis.com/discovery/v1/apis/translate/v2/rest?key=XXXXXXXXXXX with google-api-python-client==1.7.11

{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}

Hi there everybody!

If somebody keeps facing the 403: caller does not have permission alert, please write back providing the request parameters and body if any. To prevent determinate format issues, could you please clarify if this behaviour only occurs on certains emails contents?

Hi there!

Since there wasn't any answer on this issue for several days, I am going to close it due to inactivity. If you continue to have any problems, please don't hesitate to open a new case.