Google Contacts API - Accessing Other Users

Question

I am trying to use the Google Contacts API and the Python / GDATA client handlers to access Contacts via OAuth 2.0 for users in the domain. I'm ultimately wanting to create a web service to add contacts for users, but the first step is getting this test working.

I can access my own Contacts just fine if I use the default URI. However, when I pass in the email address to construct the URI for another user, I can't seem to access the other user's Contacts. Here is the code that I'm using:

client.GetContacts(uri=client.GetFeedUri(contact_list=userEmail))

A 403 error is returned when I execute this.

gdata.client.RequestError: Server responded with: 403

Your client does not have permission to get URL /m8/feeds/contacts/<userEmail>/full from this server.

Mostly just trying to understand if what I'm attempting here is even possible. In the Email Settings API, for example, you can get authenticated to the domain and pass in a user's email to list their labels, add filters, etc. So, I would anticipate that the Contacts API would work the same, though handled slightly differently, i.e. modifying the URI, instead of just passing in an argument to the client handler. Please let me know if I am wrong in that presumption.

For authorization, I'm getting the details using flow_from_clientsecrets, then getting the token to authorize the ContactsClient for the domain. Again, I can access my own contacts fine, so authorization seems OK, but I can't access other users' contacts.

client = token.authorize(ContactsClient(domain=domain))

Seems like I'm missing something with respect to accessing other users. Is anybody able to assist me over this hump? Here are some things that I've checked / confirmed:

• Contacts API is enabled for the project
• Scopes have been authorized for the Client ID in the control panel > Manage 3rd party access
• I am a Super Admin in the domain.

Thanks for your time!

Answer 1

I figured out the answer here from another post with exceptional detail:

Domain-Wide Access to Google GDATA APIs

You need to use "Service Account" authentication. For some reason, I was thinking that would only work with the newer discovery-based APIs. But, service account access also works for GDATA APIs. I can access all the Contacts for users in the domain now.