Manage User Access

Page Summary

Administrators can list users with account access by querying CustomerUserAccess entities using Google Ads Query Language.
The provided code examples demonstrate how to retrieve user access information and modify a user's access role.
You need to identify the user's access details, including their user ID, before you can modify their access role.

As an administrator, you can manage user access levels and roles for your Google Ads accounts. The Google Ads API is capable of retrieving and updating user roles, as well as terminating user access to an account. Learn more about account access levels.

Retrieve User Roles

You can get the list of users with access to an account by building a Google Ads Query Language statement to query all the CustomerUserAccess entities associated with a customer ID. Here is a typical query:

SELECT
  customer_user_access.user_id,
  customer_user_access.email_address,
  customer_user_access.access_role,
  customer_user_access.access_creation_date_time,
  customer_user_access.inviter_user_email_address
FROM customer_user_access

Modify User Roles

To update an existing user role, you need to call CustomerUserAccessService.MutateCustomerUserAccess. Use the UPDATE operation, and make sure to provide the resource name of the CustomerUserAccess to be modified, as well as the new user role.

If a multi-party approval request is triggered:

The MutateCustomerUserAccessResponse will populate the multi_party_auth_review field containing the resource name of the pending review requiring approval.
The resource_name field will not be populated.
The pending review request can be approved or rejected by a second administrator using the MultiPartyAuthReviewService.ResolveMultiPartyAuthReview method. Refer to the multi-party approval guide to learn more.

Remove Users

To terminate a user's access to the account, call CustomerUserAccessService.MutateCustomerUserAccess with a REMOVE operation.