Google Analytics' Reporting API (v3) is returning 403s, help!

wtg_google.md

Why is Google Analytics giving me 403s?

If you find this via a Google search, it's because you're seeing a 403 error in response to a Google Analytics data.get API call. You've gone through the 18 steps necessary to register a Google app, enable the Analytics API, generate a client ID as a service account, download a p12 certificate, authorize the service account email from the Google Analytics admin page, download a Google Client library in your programming language of choice, and you've finally just written a bit of code which calls the Google API for Google Analytics.

However, something is amiss! Because every request is returning the vague—and seemingly inaccurate—message, "User does not have sufficient permissions for this profile".

"But I just set all that up!", one might exclaim. And truly, there seems to be no explanation for why every call is failing. After all, you entered in your Google Analytics account ID for that API call. It's the account ID you see plastered throughout the Google Analytics control panel. It's the "12345678" portion of the very familiar UA-12345678-5 identifier.

But you were wrong! This is, in fact, not the ID you are supposed to provide the API! You're actually supposed to provide what's called the "Profile ID", instead.

So, what is the "Profile ID", you might ask? Nobody knows! Its existence isn't even documented! Nor is it displayed on any of Google's myriad control panels or admin consoles. Google has hidden it in plain sight, as if to challenge only the most eager data analyst.

To find your profile ID, first navigate to a Google Analytics report on the property you wish to analyze via the API in your browser. Go on, I'll wait.

Now, inspect the URL. It will look like this https://www.google.com/analytics/web/?authuser=1#report/visitors-overview/a12345678w55555555p87654321/. Your profile ID is actually hiding among the path section "a12345678w55555555p87654321". Let's break it down:

• a12345678 - is your account ID, the same one in your "UA-" identifier you'd have found in the Google Analytics dashboard.
• w55555555 - is some other identifier which I don't care about.
• p87654321 - is, at long last, your profile ID!

So, instead of providing "ga:12345678" as your identifier to the Google Analytics API (which yields the 403 response you've been getting), simply provide "ga:87654321" instead, and then everything will just magically, maddeningly work.

If you or your employer would like to thank me for this gist, you might consider reimbursing me for the hole I punched through my home office's drywall earlier today. You can reach me on twitter.

Yeah they don't make it easy. The profile ID is in the analytics dashboard, but it's referred to as the view ID (because why keep things consistent). It's under Admin -> View settings
They sort of explain it here https://developers.google.com/analytics/resources/concepts/gaConceptsAccounts

While I'm here, for my sins I've had to work with the GA API a lot, so feel free to hit me up if you have any questions. Also check out the analytics API explorer https://developers.google.com/apis-explorer/#s/analytics/v3/, it's pretty useful if you can ignore the constant need to re-auth.

Finally. After endless hours of headaches I stumbled upon this... Thank you! I don't understand why none of this is documented. Funny thing is, when I request a list of a users analytics accounts, I can't find the profile ID in there. The only place I've been able to find this is in the Analytics browser url, which is useless to me.

Edit: aha! You need to make a separate request for profile ID's. lol that's ridiculous.

https://github.com/google/google-api-python-client/blob/master/samples/analytics/management_v3_reference.py
Line 116

Python

profiles = service.management().profiles().list(
          accountId=firstAccountId,
          webPropertyId=firstWebpropertyId).execute()