title: Is it possible to access Provisioning API with service account?
body: <p>My service account scopes are  : <a href="https://apps-apis.google.com/a/feeds/user/" rel="nofollow">https://apps-apis.google.com/a/feeds/user/</a> and DriveScope.DRIVE</p>
  
  <p>I authorized this same scope in "Manage third party OAuth Client access" in domain settings for my service account Id.</p>
  
  <p>I use the java client of the provisioning api.</p>
  
  <p>I build my credentials with the google oauth client with a <code>GoogleCredential.Builder</code> :</p>
  
  <pre class="lang-java prettyprint-override"><code>credBuilder.setTransport(HTTP_TRANSPORT)
          .setJsonFactory(JSON_FACTORY)
          .setServiceAccountId(config.serviceAccountId)
          .setServiceAccountPrivateKeyFromP12File(new File(config.keyFilePath))
          .setServiceAccountScopes(SCOPES);
          .setServiceAccountUser("admin.of.my@domain.com")
  </code></pre>
  
  <p>I try to authorize my request to the provisioning api with</p>
  
  <pre class="lang-java prettyprint-override"><code>userService = new UserService(config.repositoryId);
  userService.setOAuth2Credentials(oAuthCredentials);
  </code></pre>
  
  <p>where <code>oAuthCredentials</code> are my previously built Service credentials.</p>
  
  <p>With that configuration i can access files and collections from the Google Drive of any user of my domain. But i can't acces the list of users of my domain with those credentials.</p>
  
  <p>If i dont specify the service account user, it doesn't work either</p>
  
  <p>Here is the stack trace i get :</p>
  
  <pre><code>com.google.gdata.util.ServiceForbiddenException: You are not authorized to access this API.
  &lt;HTML&gt;
  &lt;HEAD&gt;
  &lt;TITLE&gt;You are not authorized to access this API.&lt;/TITLE&gt;
  &lt;/HEAD&gt;
  &lt;BODY BGCOLOR="#FFFFFF" TEXT="#000000"&gt;
  &lt;H1&gt;You are not authorized to access this API.&lt;/H1&gt;
  &lt;H2&gt;Error 403&lt;/H2&gt;
  &lt;/BODY&gt;
  &lt;/HTML&gt;
  at com.google.gdata.client.http.HttpGDataRequest.handleErrorResponse(HttpGDataRequest.java:605)
  at com.google.gdata.client.http.GoogleGDataRequest.handleErrorResponse(GoogleGDataRequest.java:564)
  at com.google.gdata.client.http.HttpGDataRequest.checkResponse(HttpGDataRequest.java:560)
  at com.google.gdata.client.http.HttpGDataRequest.execute(HttpGDataRequest.java:538)
  at com.google.gdata.client.http.GoogleGDataRequest.execute(GoogleGDataRequest.java:536)
  at com.google.gdata.client.Service.getFeed(Service.java:1135)
  at com.google.gdata.client.Service.getFeed(Service.java:998)
  at com.google.gdata.client.GoogleService.getFeed(GoogleService.java:645)
  at com.google.gdata.client.Service.getFeed(Service.java:1017)
  at com.google.gdata.client.appsforyourdomain.AppsForYourDomainService.getFeed(AppsForYourDomainService.java:137)
  at foo.bar.baz.eci.gdrive.service.BaseService$1.doTry(BaseService.java:125)
  at foo.bar.baz.eci.gdrive.service.BaseService$1.doTry(BaseService.java:1)
  at foo.bar.baz.eci.gdrive.service.backoff.BackoffRequest.execute(BackoffRequest.java:50)
  at foo.bar.baz.eci.gdrive.service.BaseService.getFeedWithBackoff(BaseService.java:129)
  at foo.bar.baz.eci.gdrive.service.BaseService.retrieveAllEntries(BaseService.java:90)
  at foo.bar.baz.eci.gdrive.service.GappsUserService.getAllUserFeed(GappsUserService.java:57)
  at foo.bar.baz.eci.gdrive.GdriveContentProviderFactory.doDiscover(GdriveContentProviderFactory.java:67)
  ... 19 more
  </code></pre>
  
  <p>And the logging from the client lib :</p>
  
  <pre><code>21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setPrivateHeader
  PLUS FIN: Authorization: &lt;Not Logged&gt;
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setPrivateHeader
  PLUS FIN: Authorization: &lt;Not Logged&gt;
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setPrivateHeader
  PLUS FIN: Authorization: &lt;Not Logged&gt;
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: User-Agent: gdocsRepo GData-Java/1.47.1(gzip)
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: User-Agent: gdocsRepo GData-Java/1.47.1(gzip)
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: User-Agent: gdocsRepo GData-Java/1.47.1(gzip)
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: Accept-Encoding: gzip
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: Accept-Encoding: gzip
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: Accept-Encoding: gzip
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: GData-Version: 1.0
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: GData-Version: 1.0
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest setHeader
  PLUS FIN: GData-Version: 1.0
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  FIN: 403 You are not authorized to access this API.
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  FIN: 403 You are not authorized to access this API.
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  FIN: 403 You are not authorized to access this API.
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Encoding: gzip
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Encoding: gzip
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Encoding: gzip
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Length: 151
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Length: 151
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Length: 151
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: null: HTTP/1.1 403 You are not authorized to access this API.
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: null: HTTP/1.1 403 You are not authorized to access this API.
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: null: HTTP/1.1 403 You are not authorized to access this API.
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Expires: Wed, 21 Nov 2012 14:17:37 GMT
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Expires: Wed, 21 Nov 2012 14:17:37 GMT
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Expires: Wed, 21 Nov 2012 14:17:37 GMT
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-XSS-Protection: 1; mode=block
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-XSS-Protection: 1; mode=block
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-XSS-Protection: 1; mode=block
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-Frame-Options: SAMEORIGIN
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-Frame-Options: SAMEORIGIN
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-Frame-Options: SAMEORIGIN
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Date: Wed, 21 Nov 2012 14:17:37 GMT
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Date: Wed, 21 Nov 2012 14:17:37 GMT
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Date: Wed, 21 Nov 2012 14:17:37 GMT
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Type: text/html; charset=UTF-8
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Type: text/html; charset=UTF-8
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Content-Type: text/html; charset=UTF-8
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Server: GSE
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Server: GSE
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Server: GSE
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-Content-Type-Options: nosniff
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-Content-Type-Options: nosniff
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: X-Content-Type-Options: nosniff
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Cache-Control: private, max-age=0
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Cache-Control: private, max-age=0
  21 nov. 2012 15:17:37 com.google.gdata.client.http.HttpGDataRequest execute
  PLUS FIN: Cache-Control: private, max-age=0
  </code></pre>