Access Denied (error 49)

[danboehm]

I am attempting to query emailClick however I am getting an error 49 (Access Denied).
I can successfully query prospect and user however all other objects that are queryable are returning Access Denied.

Here's the querystring I'm sending:
https://pi.pardot.com/api/emailClick/version/4/do/query?user_key=xxxblablabla

The user that I'm authenticating with seems to have full permission to everything and can see everything in Pardot. Is there another permission that needs to be set?
Anyone else seen this?

[bingjyang]

I'm seeing the same with with emailClicks and other endpoints as well– dynamicContent and prospectAccount, for example.

Strangely enough, it works if you include credentials in the authorization header– Authorization: Pardot api_key=<api_key>, user_key=<user_key>. But this is not necessary for other queries.

[msaysell]

@bingjyang 's suggestion of the authorisation header is correct, under the homepage theres a banner stating query params are going to be deprecated

Support for passing credentials via querystring is deprecated and will be forbidden in a future version of the API. Please update your API client as soon as possible.

[creuzerm]

We have a new authentication requirement to not use the authentication elements on GET variables.
http://developer.pardot.com/#using-the-api

Note the recent documentation update on how to do a GET request.

[kanny789]

I am getting the same error using the R package. This used to work 3 months ago but now it gives an error.

Here's the R code I am using

Clicks= pardot_visitor_activities(created_after='2019-03-21', type=1)

data frame with 0 columns and 0 rows
Warning message:
In pardot_client.get_data_frame(request_url) : Access Denied

Is there a way to fix this?

[iamthefbi]

@kanny789 Try to change the R package by swifting the api key query param into the request auth header/body
I'm not an R expert but maybe you can switch the requests a bit - or you can ask the maintainer of the package to update it - but you will be definitely faster.

[BillAgner]

I am using Postman and putting user, password, & user_key into the body form-data will get you past the Access Denied. After that, you take the api_key returned from login api and use it along with user_key in Body form-data on subsequent calls to the other apis. Api_key expires after 30 minutes I believe.

[jtsternberg]

I'm getting this error while using the credentials from the Oauth Authentication: https://developer.pardot.com/kb/authentication/#oauth-authentication-domain-by-account-type

[bingjyang]

I'm getting this error while using the credentials from the Oauth Authentication: https://developer.pardot.com/kb/authentication/#oauth-authentication-domain-by-account-type

@jtsternberg I don't see an error on that page. What error are you seeing exactly? I'm curious because I've been getting access_token is invalid, unknown, or malformed when some of my clients are trying to connect and I still haven't figured out what the issue is.

[jtsternberg]

{
  "code": 49,
  "message": "Access Denied"
}

[noshirpatel-salesforce]

@jtsternberg

It's currently possible to get Access Denied when sending a Business Unit ID for a non-existent or inactive business unit. Note that if you use the wrong hostname (one of pi.pardot.com or pi.demo.pardot.com) for your request, the business unit will not be found. We will be making this error more specific in the near future.

Access Denied can also be returned in cases where the user authentication is successful, but the user does not have adequate rights to access the particular endpoint.

[bingjyang]

@noshirpatel-salesforce – do you know what might be causing the response "access_token is invalid, unknown, or malformed" when requesting with a fresh access token?

[noshirpatel-salesforce]

@bingjyang

That error is returned in a variety of circumstances. If you're seeing it for some clients and not others with a freshly obtained token, a likely cause is that some clients are trying to authenticate with users that are not synced to the business unit they are trying to access (perhaps not synced to Pardot at all).

[jtsternberg]

For me, it was the hostname (I needed to use pi.demo.pardot.com). Here's a link to any following along: https://developer.pardot.com/#test-and-production-environments

Test and Production Environments

Different Pardot environments are hosted on different domains, and you must use the correct domain in your request URLs. In general:

• Demos, developer orgs, and sandbox environments are hosted on the domain pi.demo.pardot.com.
• Training and production environments are hosted on the domain pi.pardot.com.

If you have access to the Salesforce Setup menu, you can find the correct URL for your Pardot domain:

1. In Salesforce, click the gear icon to access Setup.
2. From Setup, enter Installed Packages in the Quick Find box, and then select Installed Packages.
3. Find the package b2bmaIntegration.
   • If the namespace prefix is "b2bma", use the domain pi.pardot.com in your request URLs.
   • If the namespace prefix is "pi3", use the domain pi.demo.pardot.com in your request URLs.

[noshirpatel-salesforce]

Update: We now have a separate error code for the Business Unit ID error. Extra error detail text may now be returned in some circumstances for invalid access token errors. Also, errors because the user is not valid for a business unit will now result in Access Denied with error details indicating the user is not valid.

[shuggar]

Also having issues here.

I can confirm the updated error messages.
But it still does not work, been getting the following message:

Access Denied: User associated with access token is not valid for the Pardot Business Unit ID specified in Pardot-Business-Unit-Id header

But the user is associated correctly with Business Unit - any idea what we are doing wrong?

.

[nitinparasa]

+1 on this. Any updates or something else that needs to be configured?

[adelawalla]

@nitinparasa If you're having trouble authenticating, please contact support: https://help.salesforce.com/s/articleView?id=000386189&type=1