Getting 403 trying to call Google Cloud Endpoints API hosted on App Engine Java 8, dev app server

Question

Running an App Engine Java 8 app with Google Cloud Endpoints. I've generated the openapi.json, deployed it to my Endpoints Portal, and can see the API in my portal, with the various methods and resources listed correctly.

I'm running the dev app server locally in IntelliJ using the Cloud Code plugin. When I run it, it opens a browser tab that gives me an Error 403, with the following stack trace (abbreviated):

SEVERE: direct send of a check request service_name: "my-project-redacted.appspot.com"
operation {
  operation_id: "11b8f9a6-c9cb-4895-95fb-8bb39176efb9"
  operation_name: "1.my_project_dot_appspot_com.MyAPI"
  consumer_id: "project:my-project"
  start_time {
    seconds: 1596075164
    nanos: 812000000
  }
  end_time {
    seconds: 1596075164
    nanos: 812000000
  }
  labels {
    key: "servicecontrol.googleapis.com/caller_ip"
    value: "127.0.0.1"
  }
  labels {
    key: "servicecontrol.googleapis.com/user_agent"
    value: "ESP"
  }
  labels {
    key: "servicecontrol.googleapis.com/service_agent"
    value: "EF_JAVA/1.0.12"
  }
}
 failed
endpoints.repackaged.com.google.api.client.http.HttpResponseException: 403
{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "errors": [
      {
        "message": "The caller does not have permission",
        "domain": "global",
        "reason": "forbidden"
      }
    ],
    "status": "PERMISSION_DENIED"
  }
}

    at endpoints.repackaged.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.newExceptionOnError(AbstractGoogleClientRequest.java:456)
    at endpoints.repackaged.com.google.api.client.googleapis.services.AbstractGoogleClientRequest$1.interceptResponse(AbstractGoogleClientRequest.java:321)
    at endpoints.repackaged.com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1065)
    at endpoints.repackaged.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:419)
    at endpoints.repackaged.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:352)
    at endpoints.repackaged.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:469)
    at com.google.api.control.Client.check(Client.java:205)

It's worth noting that the API seems to work -- I have the iOS simulator connecting to my local dev app server and making Endpoints calls. I'm just tired of seeing the 403 in my browser every time I start the dev app server, and fear it may portend some similar issue in production when I eventually push this new service.

Answer 1

This error indicates that there is something wrong with the permissions or that the Service Control API is disabled in your project, so in order to fix it you can:

• Make sure your service has access to servicecontrol.googleapis.com enabled by running the following command on Cloud Shell:

  gcloud services enable servicecontrol.googleapis.com
  

• Double check ENDPOINTS_SERVICE_NAME parameter in your appengine-web.xml file, it should look like this:

  <env-var name="ENDPOINTS_SERVICE_NAME" value="$PROJECT"/>
  

• Check if OpenAPI specs are deployed to Cloud, you can check it by running this command on Cloud Shell:

  gcloud endpoints configs list --service=$PROJECT
  

• Double check if the Service account running your instance has the proper IAM roles.