title: Google Directory API returns Not Authorized when call users().list().execute()
body: <p>I need to read the list of users (and groups) from my google domain.</p>
  
  <p>So I went to my Google APIs Console and enabled <strong>Admin SDK</strong> and created a <strong>Service Account</strong> to call Google APIs. I use the following google libraries</p>
  
  <ul>
  <li>google-api-services-admin-directory_v1-rev11-1.16.0-rc.jar</li>
  <li>google-api-client-1.16.0-rc.jar</li>
  </ul>
  
  <p>My code is</p>
  
  <pre><code>     /*
       * Global instance of the JSON factory.
       */
      final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();
       /*
        Global instance of the HTTP transport.
       */
          HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();
  
          Collection&lt;String&gt; scopeList = new ArrayList&lt;&gt;();
          scopeList.add(DirectoryScopes.ADMIN_DIRECTORY_USER);
          scopeList.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP);
          scopeList.add(DirectoryScopes.ADMIN_DIRECTORY_GROUP_MEMBER);
  
          GoogleCredential credential = new GoogleCredential.Builder()
                  .setTransport(httpTransport)
                  .setJsonFactory(JSON_FACTORY)
                  .setServiceAccountId("nnnnnn@developer.gserviceaccount.com")
                  .setServiceAccountScopes(scopeList)
                  .setServiceAccountPrivateKeyFromP12File(new File("/Path/To/KeyFile/nnnnn-privatekey.p12"))
  //                .setServiceAccountUser("admin@mydomain.org")
                  .build();
  
          Directory admin = new Directory.Builder(httpTransport, JSON_FACTORY, credential)
                  .setApplicationName("Test")
                  .setHttpRequestInitializer(credential).build();
  
  
          Users users = admin.users().list().setDomain("mydomain.org").execute();
  </code></pre>
  
  <p>And I receive this on the last line</p>
  
  <p><strong>Error</strong></p>
  
  <pre><code>{
    "code" : 403,
    "errors" : [ {
      "domain" : "global",
      "message" : "Not Authorized to access this resource/api",
      "reason" : "forbidden"
    } ],
    "message" : "Not Authorized to access this resource/api"
  }
      at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:145)
      at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:113)
      at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:40)
      at com.google.api.client.googleapis.services.AbstractGoogleClientRequest$1.interceptResponse(AbstractGoogleClientRequest.java:312)
      at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1045)
      at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:410)
      at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:343)
      at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:460)
  </code></pre>
  
  <p>If I uncomment the commented line (<code>.setServiceAccountUser("admin@mydomain.org")</code>) then I get a different error</p>
  
  <pre><code>    Exception in thread "main" com.google.api.client.auth.oauth2.TokenResponseException: 400 Bad Request
  {
    "error" : "access_denied"
  }
      at com.google.api.client.auth.oauth2.TokenResponseException.from(TokenResponseException.java:105)
      at com.google.api.client.auth.oauth2.TokenRequest.executeUnparsed(TokenRequest.java:287)
      at com.google.api.client.auth.oauth2.TokenRequest.execute(TokenRequest.java:307)
      at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.executeRefreshToken(GoogleCredential.java:269)
      at com.google.api.client.auth.oauth2.Credential.refreshToken(Credential.java:489)
      at com.google.api.client.auth.oauth2.Credential.intercept(Credential.java:217)
      at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:858)
      at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:410)
      at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:343)
      at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:460)
  </code></pre>
  
  <p>My account (admin@mydomain.org) is a <strong>super administrator</strong>. I suspect the Service Account needs to be granted access for the <strong>users API scope</strong>. But <strong>I can not find where I can grant this access</strong>. I have a classic UI mode of my Google CPanel. And I don't have "Manage client API access" page in the Advanced tools.</p>
  
  <p><img src="https://i.stack.imgur.com/Ju7EG.png" alt="Advanced tools"></p>
  
  <p>Also I'm not sure what I should use as an Application Name at <code>.setApplicationName("Test")</code>.</p>
  
  <p>Thanks for any help</p>