PERMISSION_DENIED: Permission 'documentai.processors.processOnline' denied on resource '//documentai.googleapis.com/project...'(or it may not exist)."

Question

ISSUE: i want to use the same documents ai custom-trained processor from several different projects. the approach i have in mind is to make api calls from each of those projects to the a single service account that has the proper AIM roles. i have not been able to successfully set up a service account to access the ai processor we trained

SUMMARY: I have three different projects

DEV
STAGING
DOCUMENT AI PROCESSING

The** DOCUMENT AI PROCESSING** project contains the document AI processor which was custom-trained and the 2 other environments listed above need to access the same endpoint. I cannot find the right way to configure this, at the moment i am getting the following error: PERMISSION_DENIED: Permission 'documentai.processors.processOnline' )

BACKGROUND:

(1) I created a service account

(2) I grant this service account access to project, but did not grant any users access to the service account (item 3 in the screenshot)

(3) service account created successfully

(4) i add (as a principal) the newly created service account to the DEV project and assign it *EXACTLY* the same roles as what it has in the DOCUMENT AI PROCESSING project

(5) the service account has been granted access to the DEV project

What I expect to happen is to be able to use the Document AI processor which is located in DOCUMENT AI PROCCESSING project from the DEV project**.** However, I am still receiving the same error: PERMISSION_DENIED: Permission 'documentai.processors.processOnline' denied on resource '//documentai.googleapis.com/project...'(or it may not exist)."

After many hours, i am stumped and i am grateful to anyone that can provide an explanation of what i am getting wrong

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. — Community, Jan 04 '23 at 20:05
What I think I'd like to see in more detail is how you are INVOKING the DocAI processing from your DEV project. I understand that the processor is defined in project "DOCAI-PROC" and being leveraged from "DEV" but I'm not yet understanding how you are specifying that. It looks like it should be this API: https://cloud.google.com/document-ai/docs/reference/rest/v1/projects.locations.processors.processorVersions/process — Kolban, Jan 04 '23 at 20:33
@Kolban thanks to the link you shared I figured out how to solve the issue and it was related to Authorization Scopes. thanks a lot. — bismar eyner esquivel ortuste, Jan 05 '23 at 23:35

score 0 · Answer 1 · answered Jan 17 '23 at 18:16

As mentioned in the comment exchange of @Kolban and @bismar eyner esquivel ortuste, the correct permissions needed must be added to the Authorization Scope.

You may refer to this Document AI IAM roles documentation for the full list of roles for the API and refer to Document AI Processor REST API documentation for more information.

Posting the answer as community wiki for the benefit of the community that might encounter this use case in the future.

Feel free to edit this answer for additional information.

PERMISSION_DENIED: Permission 'documentai.processors.processOnline' denied on resource '//documentai.googleapis.com/project...'(or it may not exist)."

1 Answers1