dialogflow: 403 IAM permission 'dialogflow.sessions.detectIntent'

Question

After hours of reading docs and resources, I am asking for your help.

I have a dialog flow agent on API V2 project "xxx1"

I have created a service account for "xxx1" and attached role "Dialogflow API Client"

I downloaded the JSON file with credentials.

I create the session in python with:

session = dialogflow.SessionsClient(
        {
            'credentials': {
                'client_email': 'serviceaccountemail...',
                'private_key': '-----BEGIN PRIVATE KEY----- ...',
            },
            'project_id': 'xxx1',
        }
    )

No issues here.

If I call the Dialogflow API during runtime I receive:

grpc._channel._Rendezvous: <_Rendezvous of RPC that terminated with:
status = StatusCode.PERMISSION_DENIED
details = "IAM permission 'dialogflow.sessions.detectIntent' on 'projects/xxx1/agent' denied."
debug_error_string = "{"created":"@1534320091.581347198","description":"Error received from peer","file":"src/core/lib/surface/call.cc","file_line":1095,"grpc_message":"IAM permission 'dialogflow.sessions.detectIntent' on 'projects/xxx1/agent' denied.","grpc_status":7}"

For me, this sounds as if the permissions are not sufficient. But I use the same role for other agent and it works fine.

Answer 1

I faced the same issue while integrating Dialogflow with external client.

The root cause for my case was that even though I created the service account for my external client, I forgot to add the service account and give "Dialogflow API Admin' Role.

How I resolve: In GCP project, go to IAM > click the top "+ADD" button and search for the service account that you want to grant permission access, choose role type "Dialogflow API Admin" (or edit the role to give Dialogflow API Admin if you have added the service account previously as Client role)