3

In Facebook ad-accounts, one can add other facebook accounts to create/view/manage campaigns. So a account "A" can have multiple ad-accounts under him. Though he is not admin of these accounts. The only extra privilege that admin of any ad-account has is I guess just to be able to view and edit Credit Card info.

Now the adaccount "A" has authorized my app with ads_management, ads_read permission. But using A's access_token I am not able to fetch campaigns of ad-accounts which are managed by A since A is not admin of these account. Which I think is wrong, since A is able to manage ads through Dashboard, using A's token I should be able to fetch campaigns through API as well.

I get following error:

{   "error": {
    "message": "(#10) You do not have sufficient permissions to perform this action", 
    "type": "OAuthException", 
    "code": 10   } }

Can someone tell me If I am doing something wrong or is there any other way in which I can fetch campaigns of adaccount. I cannot make my user to login with each adaccount into my app. The user would login only with the one account he uses to manage all his other brand accounts.

Vishwesh Shetty
  • 687
  • 9
  • 27

4 Answers4

2

Given the generic nature of the permissions error, this is not the one answer for everyone, but after wasting a significant amount of time on this, it turned out the problem (for me) was this:

  1. I had been added correctly as an Ad Account Advertiser
  2. I had not been added to the relevant Account Groups

When the second point was addressed, I no longer encountered the OAuthException: (#10) You do not have sufficient permissions to perform this action error. For reference, the Account Groups section is currently accessible via "Settings" in the Ad Manager left sidebar and is located under the "Ad Account Roles" section of the Settings page.

Ben
  • 494
  • 3
  • 9
1

Facebook permissions revolve around users, not accounts. A user is given access to manage a set of adaccounts.

The adaccounts they are able to manage can be found by making a request to me/adaccounts on the graph. If you do not see the adaccount within this set, then the user does not have access.

Additionally, users have roles. The roles are as follows and can be read from the users connection on adaccount:

Level 1001, administrator access
Level 1002, general-user access
Level 1003, reports-only access

If the user has the role reports-only access the will not be able to read everything about an ad account.

Paul Bain
  • 4,364
  • 1
  • 16
  • 30
  • The user has general-user access, and me/adaccounts gives me all adaccounts, but when I click on the particular adaccount in graph explorer tool I get insufficient permissions error. – Vishwesh Shetty Sep 23 '14 at 10:04
  • you shouldn't post access tokens publicly, that's super dangerous. You should de-auth the app to make sure the access token isn't used. – Paul Bain Sep 23 '14 at 14:25
  • but users with reports-only access only have access to reports... you should try the reportstats or stats endpoints. – Paul Bain Sep 23 '14 at 14:27
  • Oops I thought I am anyways was not able to fetch or do anything with that access_token, so i posted it so you have more clarity. Deleted it. BTW I assumed general-user access has all privilege of reports-only + it has privilege to create campaigns. Am i wrong?. For fetching reports should the user have "reports-only access"? So If i add a user to all accounts with report only access, will I be able to fetch the campaigns with that user? – Vishwesh Shetty Sep 24 '14 at 05:42
  • if you have general user access you should be able to do anything. You need to check the access level number under the users connection of adaccount to see. – Paul Bain Sep 24 '14 at 10:35
  • My app currently has only developer access, is it because of this that I am not able to fetch campaigns from general-user? – Vishwesh Shetty Sep 25 '14 at 17:18
  • just disable developer mode, it's not really relevant to Ads API Apps – Paul Bain Sep 26 '14 at 11:58
  • By developer access, I mean I have not got production level access on Ads Api for this app. The app is still under rate limits. I want to know if I submit my app for approval through CaseTool, would I be able to fetch campaigns from general user? – Vishwesh Shetty Sep 27 '14 at 18:30
  • https://developers.facebook.com/docs/reference/ads-api/access has the details of the different access levels and how to apply - development level access allows updates only to a maximum of 5 accounts, and on behalf of users who are both admins of the ad account and of the app – Igy Nov 12 '14 at 18:54
  • 1
    Where can I find in the Facebook documentations what user roles are required to access a particular API call ( /act_xxxxx/adgroups in my case ) ? – Crocodile May 12 '15 at 15:36
  • Hi, there, I do have admin permission for multiple business managers, and I should have access to all the ad accounts belongs to the business managers (less than 25 ad-accounts), but I still got this error for all ad-account from one business manager, any idea about this? Thanks – zhihong Mar 29 '16 at 16:03
0

Just ran into this issue myself.

The issue was that we couldn't add users as "Ad Account Admins" from the standard ad account interface.

Once we "claimed" the ad account using from the new business.facebook.com site the option to add a user as an Admin was available.

The option is under "Settings > Ad Accounts" at https://business.facebook.com

Steven
  • 1,107
  • 1
  • 8
  • 21
0

My account is admin of Ad Account but it cannot execute API: GetAdsUser() and GetCampaigns().

AdAccount adAccount = new AdAccount("act_{add-account-id}");
var adUsers = adAccount.GetAdUsers();
var campains = adAccount.GetCampaigns();

It throw an exception:(#10) You do not have sufficient permissions to perform this action. What's happen with my account or my facebook application?

dinhienhy
  • 15
  • 6