Reports API access for Google Admin

Question

First, I have admin privilege on my domain but I do not have access to security. I am working with my I.T. department, which does have security access, however, everything we've found seems to be enabled on our account. App access control is set to "Trust internal, domain-owned apps". Every time I try to run just the basic quickstart for UserUsageReport (https://developers.google.com/apps-script/advanced/admin-sdk-reports#reference) I get an error:

/**
 * Generates a user usage report for this day last week as a spreadsheet. The
 * report includes the date, user, last login time, number of emails received,
 * and number of drive files created.
 */
function generateUserUsageReport() {
  var today = new Date();
  var oneWeekAgo = new Date(today.getTime() - 7 * 24 * 60 * 60 * 1000);
  var timezone = Session.getScriptTimeZone();
  var date = Utilities.formatDate(oneWeekAgo, timezone, 'yyyy-MM-dd');

  var parameters = [
    'accounts:last_login_time',
    'gmail:num_emails_received',
    'drive:num_items_created'
  ];
  var rows = [];
  var pageToken;
  var page;
  do {
    page = AdminReports.UserUsageReport.get('all', date, {
      parameters: parameters.join(','),
      maxResults: 500,
      pageToken: pageToken
    });
    if (page.warnings) {
      for (var i = 0; i < page.warnings.length; i++) {
        var warning = page.warnings[i];
        Logger.log(warning.message);
      }
    }
    var reports = page.usageReports;
    if (reports) {
      for (var i = 0; i < reports.length; i++) {
        var report = reports[i];
        var parameterValues = getParameterValues(report.parameters);
        var row = [
          report.date,
          report.entity.userEmail,
          parameterValues['accounts:last_login_time'],
          parameterValues['gmail:num_emails_received'],
          parameterValues['drive:num_items_created']
        ];
        rows.push(row);
      }
    }
    pageToken = page.nextPageToken;
  } while (pageToken);

  if (rows.length > 0) {
    var spreadsheet = SpreadsheetApp.create('G Suite User Usage Report');
    var sheet = spreadsheet.getActiveSheet();

    // Append the headers.
    var headers = ['Date', 'User', 'Last Login', 'Num Emails Received',
      'Num Drive Files Created'];
    sheet.appendRow(headers);

    // Append the results.
    sheet.getRange(2, 1, rows.length, headers.length).setValues(rows);

    Logger.log('Report spreadsheet created: %s', spreadsheet.getUrl());
  } else {
    Logger.log('No results returned.');
  }
}

/**
 * Gets a map of parameter names to values from an array of parameter objects.
 * @param {Array} parameters An array of parameter objects.
 * @return {Object} A map from parameter names to their values.
 */
function getParameterValues(parameters) {
  return parameters.reduce(function(result, parameter) {
    var name = parameter.name;
    var value;
    if (parameter.intValue !== undefined) {
      value = parameter.intValue;
    } else if (parameter.stringValue !== undefined) {
      value = parameter.stringValue;
    } else if (parameter.datetimeValue !== undefined) {
      value = new Date(parameter.datetimeValue);
    } else if (parameter.boolValue !== undefined) {
      value = parameter.boolValue;
    }
    result[name] = value;
    return result;
  }, {});
}

The error I am getting is:

GoogleJsonResponseException: API call to reports.userUsageReport.get failed with error: Caller does not have access to the customers reporting data.

I meet the three requirements of the above link, as far as I can tell, which are:

API access enabled

Google account with admin privileges

Access to Google Drive

So why do I keep getting this error? Is there a setting that my I.T. is missing to enable this? I have complete access to directory_v1 but reports_v1 gives me the same error every time I try to call it. We've even followed the instructions here: https://support.google.com/a/answer/7281227?visit_id=637781417279518974-3468793296&rd=1#zippy=%2Creview-the-third-party-apps-in-your-environment%2Cblock-all-third-party-api-access

Any help is appreciated.

Answer 1

• Definitely try calling the same method in API explorer as mentioned by @Fernando Lara to investigate user permissions and rule-out any session issues as well.
• In addition to that make sure the caller of this script has Reports Admin privilege enabled as stated on this documentation.
• One scenario you might encounter is regarding the "scopes cache/caller" on your script project. Since the Apps Scripts editor automatically controls the authorization scopes given the code context, I've noticed that sometimes when you modify domain-level permissions, some kind of scope cache is retained in the project. To workaround that, I just cut my code to a notepad, add a blank function calling DriveApp.getFiles();, save my project and run this method. Re-authorize the Drive scope, let it finish then delete everything and paste your code again and run it to trigger the OAuth flow once again.

Answer 2

I think the problem could be related to the specific admin roles that your account may have. Since you mention that you do not have access to the Security section of the Admin console, this means you are not a super admin and just have specific admin roles assigned to your account.

I would recommend making a test using the "Try this API" function from the API explorer first, just to discard the admin roles issue. If it fails with the same error it means the problem is related to the admin roles. Or you can just ask if your user has the Reports admin role assigned.