CODEWITHSUNDEEP
google-cloud-platformchatbotdialogflow-esservice-accounts
Pranshu Dixit
Pranshu Dixit

Reputation: 121

PermissionDenied: 403 IAM permission 'dialogflow.intents.list'

I'm trying to get the list of the intents in my Dialogflow agent using Dialogflow's V2 APIs but have been getting the following error:

PermissionDenied: 403 IAM permission 'dialogflow.intents.list' on 'projects/xxxx/agent' denied.

I adopted the following steps:

  1. I created a new agent(with V2 APIs enabled) and a new service account for it.
  2. I downloaded the JSON key and set my GOOGLE_APPLICATION_CREDENTIALS variable to its path.

Following is my code:

import dialogflow_v2 as dialogflow

os.environ["GOOGLE_APPLICATION_CREDENTIALS"]="/home/user/folder/service-account-key.json"

client=dialogflow.IntentsClient()

parent = client.project_agent_path('[PROJECT_ID]')

for element in client.list_intents(parent):
    pass

I have made various agents and service accounts and even changed the role from Admin to Client but can't figure out any solution. I tried the following solution but didnt' work

Tried Solution: DialogFlow PermissionDenied: 403 IAM permission 'dialogflow.sessions.detectIntent'

Upvotes: 11

Views: 14778

Answers (8)

SenthurLP
SenthurLP

Reputation: 172

I think you might have missed the Enable the API section in the documentation setup.

Here is that link: https://cloud.google.com/dialogflow/cx/docs/quick/setup#api

After clicking the link, select the chatbot project you created and fill the necessary instructions given there.

The permissions that I have given for that project are Owner, and editor.

After this, try the code in this link: https://cloud.google.com/dialogflow/es/docs/quick/api#detect_intent You should get a response from your chatbot

Hope this helps!

Upvotes: 0

jonddon
jonddon

Reputation: 1

You need to create the following as environment variable googleProjectID: "", dialogFlowSessionID: "anything", dialogFlowSessionLanguageCode: "en-US", googleClientEmail: "", googlePrivateKey:

Upvotes: 0

Marian Turchyn
Marian Turchyn

Reputation: 559

Try also to create project in DialogFlow Console https://dialogflow.cloud.google.com/

Upvotes: 0

Rishabh Batra
Rishabh Batra

Reputation: 718

There is no need for creating a new Agent. You can edit the existing agents IAM.

  1. In Dialogflow's console, go to settings ⚙ > under the general tab, you'll see the project ID section with a Google Cloud link to open the Google Cloud console > Open Google Cloud.
  2. In google cloud, go to IAM Admin > IAM under tab Members. Find the name of your agents and then click on edit.
  3. Give admin permissions to the agent to give permissions to list intent.

Upvotes: 13

BcK
BcK

Reputation: 2821

The problem lies in the IAM section of GCP. Probably you are making a POST request with a role that does not have the necessary authorizations.

  1. Look into your key.json file that contains the field "client_email"
  2. Proceed to the IAM page and set the relevant role with that email to a role that has posting capabilities. (e.g. Admin)

This solved my problem.

Upvotes: 5

user10996754
user10996754

Reputation: 11

When you create the intentClient, use following:

key_file_path = "/home/user/folder/service-account-key.json";
client=dialogflow.IntentsClient({
        keyFilename: key_file_path
})

Intents list

Upvotes: 1

Sarah Dwyer
Sarah Dwyer

Reputation: 529

  1. In Dialogflow's console, go to settings ⚙ > under the general tab, you'll see the project ID section with a Google Cloud link to open the Google Cloud console > Open Google Cloud.
  2. (Optional) In the Cloud console, go to the menu icon > APIs & Services > Library. Select any APIs (if any) > Enable.
  3. In Cloud Console > under the menu icon ☰ > APIs & Services > Credentials > Create Credentials > Service Account Key. Under Create service account key, select New Service Account from the dropdown and enter a project name and for role choose Owner > Create.
    • JSON private key file will be downloaded to your local machine that you will need.

For Javascript: In the index.js file you can do service account auth with JWT: 

const serviceAccount = {};       // Starts with {"type": "service_account",...

// Set up Google Calendar Service account credentials
  const serviceAccountAuth = new google.auth.JWT({
  email: serviceAccount.client_email,
  key: serviceAccount.private_key,
  scopes: 'https://www.googleapis.com/auth/xxxxxxx'
});

For Python: There's a Google Auth Python Library available via pip install google-auth and you can check out more here.

Upvotes: 3

Armin_SC
Armin_SC

Reputation: 2260

This error message is usually thrown when the application is not being authenticated correctly due to several reasons such as missing files, invalid credential paths, incorrect environment variables assignations, among other causes. Keep in mind that when you set an environment variable value in a session, it is reset every time the session is dropped.

Based on this, I recommend you to validate that the credential file and file path are being correctly assigned, as well as follow the Obtaining and providing service account credentials manually guide, in order to explicitly specify your service account file directly into your code; In this way, you will be able to set it permanently and verify if you are passing the service credentials correctly.

Passing the path to the service account key in code example:

def explicit():
from google.cloud import storage

# Explicitly use service account credentials by specifying the private key
# file.
storage_client = storage.Client.from_service_account_json('service_account.json')

# Make an authenticated API request
buckets = list(storage_client.list_buckets())
print(buckets)

Upvotes: 0

Related Questions