title: Google Directory API: 403 when retrieving user information with service account
body: <p>This is likely related to <a href="https://stackoverflow.com/questions/46350946/google-directory-api-returns-403-for-user-list-with-showdeleted-true">Google Directory API returns 403 for user_list with showDeleted=true</a> but I am unfortunately unable to comment yet, and I don't have an answer to offer.</p>
  
  <p>I received a <a href="https://developers.google.com/identity/protocols/OAuth2ServiceAccount" rel="noreferrer">service account</a> from a school's G Suite with the permission</p>
  
  <pre><code>https://www.googleapis.com/auth/admin.directory.user.readonly
  </code></pre>
  
  <p>The G Suite admin indicated he has delegated domain-wide authority to the account, and I'm able to create the service account JWT and retrieve the access token to call the APIs using the HTTP/REST flow. However, when I call the <a href="https://developers.google.com/admin-sdk/directory/v1/reference/users/get" rel="noreferrer">user get endpoint</a> to request information about an account -</p>
  
  <pre><code>https://www.googleapis.com/admin/directory/v1/users/redacted%40redacted.com?projection=full
  </code></pre>
  
  <p>I receive the following:</p>
  
  <pre><code>The remote server returned an error: (403) Forbidden.
  {
    "error": {
      "errors": [
        {
          "domain": "global",
          "reason": "forbidden",
          "message": "Not Authorized to access this resource/api"
        }
      ],
      "code": 403,
      "message": "Not Authorized to access this resource/api"
    }
  }
  </code></pre>
  
  <p>I don't have access to their G Suite admin panel so I'm unable to poke around myself, but the admin has confirmed that our client has access to the admin.directory.user.readonly permission everywhere he can find, and we are in a role that has domain-wide access, as noted above. I'm open to suggestions for places the admin might be missing an assigned permission, or anything I might be missing in my approach (though the JWT build/sign and access token retrieval <em>appear to be</em> working as expected). If there's any other useful information I can provide please let me know and I'll update.</p>
  
  <p>UPDATE: The permissions on the account appear to be correct - I was able to retrieve information from users/get in the API Explorer. However, the API Explorer is using the URL</p>
  
  <pre><code>https://www.googleapis.com/admin/directory/v1/users/redacted%40redacted.com?projection=full&amp;key={YOUR_API_KEY}
  </code></pre>
  
  <p>and I can't find any documentation on the key parameter, either in the Service Account or users/get documentation. I'm including the access_token as a Bearer token in the authentication header as defined in the specs, and when I tried sending it as the key querystring parameter I still received the same 403 error documented above. There's a similar question on Stack (<a href="https://stackoverflow.com/questions/37357373">Google API Client users().get(userKey=&#39;name@domain.com&#39;) returns Not Authorized to access this resource/api</a>) with no answer.</p>