Google-api-dotnet-client: The caller does not have permission [403] when calling Dynamic Links Analytics API

[jakubbloksa]

I am trying to get dynamic link stats via Dynamic Links Analytics API with the method FirebaseDynamicLinksService.V1.GetLinkStats()... I was able to create a short link easily and it works... But the problem is to get the stats about this dynamic link.

I got 403: "Google.Apis.Requests.RequestError The caller does not have permission [403] Errors [Message[The caller does not have permission] Location[ - ] Reason[forbidden] Domain[global]]"

Is there something I am missing? I tried to follow this https://firebase.google.com/docs/reference/dynamic-links/analytics

My code basically looks like this:

var googleCredential = GoogleCredential.FromFile(shortLinkServiceConfiguration.KeyFileName).CreateScoped($"https://www.googleapis.com/auth/firebase");
var dynamicLinksService = new FirebaseDynamicLinksService(new Google.Apis.Services.BaseClientService.Initializer
        {
            HttpClientInitializer = googleCredential,
            ApplicationName = shortLinkServiceConfiguration.ApplicationName
        });

var request = dynamicLinksService.ShortLinks.Create(createShortDynamicLinkRequest);
request.AccessToken = googleCredential.UnderlyingCredential.GetAccessTokenForRequestAsync().Result;

// This works and I get the short link
var response = request.Execute();

var secondRequest = dynamicLinksService.V1.GetLinkStats(response.ShortLink);
secondRequest.AccessToken = googleCredential.UnderlyingCredential.GetAccessTokenForRequestAsync().Result;
secondRequest.DurationDays = 7;

// This does not work and I get 403 
var secondResponse = secondRequest.Execute();

[jskeet]

I'm afraid the maintainers of this repository don't tend to know much about individual APIs - and in particular, it looks like the Firebase API is using a different authentication mechanism than normal. (It's odd to have the access token in the request object itself instead of just being applied on the HTTP request).

It looks like it should be okay, and particularly as the first request works, it's odd that the second doesn't.

Could you try making the same requests in the API Explorer? I'll try doing that myself as well...

[jskeet]

Hmm... I'm confused that API Explorer doesn't even mention the access token. It might be worth using Fiddler2 or something similar to see what the request looks like on the wire, and compare that with the user guide. I'll try using your code to reproduce the issue.

[jskeet]

Hmm... I just tried creating a dynamic link in the console (for simplicity) then using this code to fetch the stats:

using Google.Apis.Auth.OAuth2;
using Google.Apis.FirebaseDynamicLinks.v1;
using Google.Apis.FirebaseDynamicLinks.v1.Data;
using Google.Apis.Services;
using System;
using System.Linq;

namespace Issue1448
{
    class Program
    {
        private const string CredentialFile = "...";
        private const string DynamicLink = "https://...";

        static void Main(string[] args)
        {
            var googleCredential = GoogleCredential.FromFile(CredentialFile)
                .CreateScoped(FirebaseDynamicLinksService.Scope.Firebase);
            var dynamicLinksService = new FirebaseDynamicLinksService(new BaseClientService.Initializer
            {
                HttpClientInitializer = googleCredential
            });

            var request = dynamicLinksService.V1.GetLinkStats(DynamicLink);
            request.DurationDays = 7;

            var response = request.Execute();
            foreach (var stat in response.LinkEventStats ?? Enumerable.Empty<DynamicLinkEventStat>())
            {
                Console.WriteLine($"{stat.Platform}: {stat.Count}");
            }
        }
    }
}

I didn't even need to specify the access token - although it worked when I did, too. (Admittedly I've not seen any stats yet, but the console doesn't show any clicks yet either.)

Could you check the value of the short link that you're passing into GetLinkStats? I wonder whether it doesn't have the https:// part, or something similar. If you've already created the link, please try my code in this comment.

[jakubbloksa]

I've tried to put the link (https://streambee.page.link/Posx) in API exlorer and this is what I got:
Request

GET https://firebasedynamiclinks.googleapis.com/v1/https%3A%2F%2Fstreambee.page.link%2FPosx/linkStats?durationDays=7&key={YOUR_API_KEY}

Response

403 Forbidden


- Show headers -


{
 "error": {
  "code": 403,
  "message": "Firebase Dynamic Links API has not been used in project 292824132082 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/firebasedynamiclinks.googleapis.com/overview?project=292824132082 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.",
  "status": "PERMISSION_DENIED",
  "details": [
   {
    "@type": "type.googleapis.com/google.rpc.Help",
    "links": [
     {
      "description": "Google Developers Console API activation",
      "url": "https://console.developers.google.com/apis/api/firebasedynamiclinks.googleapis.com/overview?project=292824132082"
     }
    ]
   }
  ]
 }
}

When I try to visit https://console.developers.google.com/apis/api/firebasedynamiclinks.googleapis.com/overview?project=292824132082
It says Failed to load... I think that this project ID is incorrect...

[jakubbloksa]

I've tried it previously without the Access token... I was unable to create short link without it, so I thought it has to be filled in as well... I got 403 with or without it on GetLinkStats though.

[jskeet]

Yes, it looks like API Explorer doesn't work for this - it's defaulting to an unrelated project. (I get the same issue, with the same project.) Sorry for that red herring.

Does the link display correctly in the Firebase console? And is your service account file definitely the one for the Firebase project that owns that link?

[jakubbloksa]

No worries, thanks for help.
The link does not display in Firebase console, but I've found that it is by design, because it is created by ShortLinks.Create not ManagedShortLinks.Create (This method is not yet implemented https://stackoverflow.com/a/50262179/3578133) ...
It should be available for stats via REST API anyways...

Service account is the same with which I created the link, so I am not sure what could be different

[jskeet]

Ah, that's interesting.

I've found that I'm able to request stats for a link that doesn't exist, so long as the hostname is correct. Is it feasible for you to create a managed short link in the console, for the same hostname, but with a different path? I wonder whether then you might be able to get at the other short link too.

I'm really guessing at this point - I'm afraid I think you need a Firebase expert. It might be worth asking in the Google Group to get the attention of more Firebase-oriented users.

[jakubbloksa]

I've created managed short link in the console (https://streambee.page.link/1B33) ... and put it in the API explorer with the same 403 result... Thanks for your help, I will try to ask there, too.

[jskeet]

No, that won't help in API Explorer - as I said before, API Explorer basically isn't going to work for this due to it somehow being hard-coded for the wrong project. But I'd expect the code I provided earlier to work.

[jakubbloksa]

Ok, so the same result with manually created managed short link... With your code and mine (with or without specifying the AccessToken in the request)...

[jskeet]

Okay, one final thing to check - the IAM permissions of the service account you're using.

I just managed to reproduce your problem with a freshly-created service account with no permissions. I then added the "Firebase Grow Viewer" role to the service account in the IAM dashboard and the error went away. Could you check what roles your service account has access to, and try adding "Firebase Grow Viewer" if it's not already there?

[jakubbloksa]

This solved the problem! Thanks! It is weird that I have not seen this role to be necessary anywhere...
I've had Firebase Analytics Admin, Firebase Develop Admin, Firebase Admin SDK Administrator Service Agent, Service Account Token Creator and that was not enough.

[jskeet]

Hooray - I'm glad that worked :) I guess Grow is a separate thing...