As an administrator, you can manage user access levels and roles for your
Google Ads accounts. You can retrieve and update user roles, send user
invitations, and terminate user access to an account using the Google Ads API.
[Learn more about account access levels](https://support.google.com/google-ads/answer/9978556).

To manage user access, the calling user or service account must have `ADMIN`
access to the target account.

## Invite users

To invite a new user to access an account, use the
[`CustomerUserAccessInvitationService`](https://developers.google.com/google-ads/api/reference/rpc/v26/CustomerUserAccessInvitationService) to create and send an invitation (see
[Manage user access invitations](https://developers.google.com/google-ads/api/docs/account-management/managing-invitations)). Once the user accepts the
invitation, they will appear as a confirmed user under `CustomerUserAccess`.

## Retrieve user roles

You can get the list of users with access to an account by building a
[Google Ads Query Language](https://developers.google.com/google-ads/api/docs/query/overview) statement to query all the
[`CustomerUserAccess`](https://developers.google.com/google-ads/api/reference/rpc/v26/CustomerUserAccess) entities associated
with a customer ID. Here is a typical query:

    SELECT
      customer_user_access.user_id,
      customer_user_access.email_address,
      customer_user_access.access_role,
      customer_user_access.access_creation_date_time,
      customer_user_access.inviter_user_email_address
    FROM customer_user_access

> [!NOTE]
> **Note:** Querying `customer_user_access` returns only confirmed users. Pending invitations can be queried using [`customer_user_access_invitation`](https://developers.google.com/google-ads/api/fields/v26/customer_user_access_invitation).  
>
> If a user access level change is pending a multi-party approval, then it won't show up when retrieving user access lists using the [`GoogleAdsService.Search`](https://developers.google.com/google-ads/api/reference/rpc/v26/GoogleAdsService/Search) or [`GoogleAdsService.SearchStream`](https://developers.google.com/google-ads/api/reference/rpc/v26/GoogleAdsService/SearchStream) method.

## Modify user roles

To update an existing user role, call
`CustomerUserAccessService.MutateCustomerUserAccess` using the `UPDATE`
operation. When modifying a user role, you must provide:

- The resource name of the `CustomerUserAccess` entity to modify, in the format `customers/{customer_id}/customerUserAccesses/{user_id}`.
- The new user role in `access_role`.
- An `update_mask` (`FieldMask`) specifying `access_role`.

> [!NOTE]
> **Note:** The API will reject requests to downgrade the last `ADMIN` user on a manager account ([`CustomerUserAccessError.LAST_ADMIN_USER_OF_MANAGER`](https://developers.google.com/google-ads/api/reference/rpc/v26/CustomerUserAccessErrorEnum.CustomerUserAccessError#last_admin_user_of_manager)) or on an active serving account that does not have an owner manager ([`CustomerUserAccessError.LAST_ADMIN_USER_OF_SERVING_CUSTOMER`](https://developers.google.com/google-ads/api/reference/rpc/v26/CustomerUserAccessErrorEnum.CustomerUserAccessError#last_admin_user_of_serving_customer)).

## Remove users

To terminate a user's access to the account, call
`CustomerUserAccessService.MutateCustomerUserAccess` with a `REMOVE`
operation specifying the resource name
(`customers/{customer_id}/customerUserAccesses/{user_id}`).

> [!NOTE]
> **Note:** As with role downgrades, the API rejects requests to remove the last `ADMIN` user on a manager account ([`LAST_ADMIN_USER_OF_MANAGER`](https://developers.google.com/google-ads/api/reference/rpc/v26/CustomerUserAccessErrorEnum.CustomerUserAccessError#last_admin_user_of_manager)) or on an active serving account without an owner manager ([`LAST_ADMIN_USER_OF_SERVING_CUSTOMER`](https://developers.google.com/google-ads/api/reference/rpc/v26/CustomerUserAccessErrorEnum.CustomerUserAccessError#last_admin_user_of_serving_customer)).

## Multi-party approval for access changes

> [!NOTE]
> **Note:** The Google Ads API may generate a multi-party approval request when modifying or removing user roles. Refer to the [multi-party approval
> guide](https://developers.google.com/google-ads/api/docs/oauth/multi-party-approvals) to learn more.

If a multi-party approval request is triggered when calling
`MutateCustomerUserAccess`:

- The [`MutateCustomerUserAccessResult`](https://developers.google.com/google-ads/api/reference/rpc/v26/MutateCustomerUserAccessResult) object (contained within the `result` field of [`MutateCustomerUserAccessResponse`](https://developers.google.com/google-ads/api/reference/rpc/v26/MutateCustomerUserAccessResponse)) will populate the [`multi_party_auth_review`](https://developers.google.com/google-ads/api/reference/rpc/v26/MutateCustomerUserAccessResult#multi_party_auth_review) field with the resource name of the pending review requiring approval.
- The `resource_name` field on `MutateCustomerUserAccessResult` will **not** be populated.
- The pending review request can be approved or rejected by a second administrator using the [`MultiPartyAuthReviewService.ResolveMultiPartyAuthReview`](https://developers.google.com/google-ads/api/reference/rpc/v26/MultiPartyAuthReviewService/ResolveMultiPartyAuthReview) method. Refer to the [multi-party approval
  guide](https://developers.google.com/google-ads/api/docs/oauth/multi-party-approvals) to learn more.