LinkedIn Marketing API OAuth scope boundaries for Ad Account management

Question

Ad Account Permission Hierarchy
When integrating a third-party application with the LinkedIn Marketing Developer Platform, the rw_ads scope provides the necessary write access for managing sponsored updates. However, the API enforces a strict hierarchy where the application's capabilities are bounded by the authenticated user's specific role within the LinkedIn Campaign Manager.

Configuration Uncertainty
In scenarios where an application must manage multiple ad accounts across different organizational structures, it is unclear how the API handles token validation when a user's role is downgraded or removed from a specific Ad Account while an active OAuth 2.0 access token remains valid.

Does the API perform a real-time permission check against the Campaign Manager role for every request?
What is the expected behavior when a token with rw_ads scope attempts to modify an entity for which the user no longer holds the required administrative role?

Tasadduq Burney · Answer

Permission Enforcement Logic
The LinkedIn Marketing API utilizes a two-tier authorization process. The rw_ads OAuth scope grants the application the technical capability to call write-enabled endpoints, but it does not grant data-level access. Access to specific ad accounts is governed by the authenticated user's current role within the LinkedIn Campaign Manager.

Real-Time Validation
The API performs a real-time permission check against the Campaign Manager Access Control List (ACL) for every request. An OAuth 2.0 access token is a credential that proves the user has delegated a specific set of capabilities to the app; it is not a static snapshot of the user's permissions.

Behavior During Role Downgrades
If a user's role is downgraded or removed from an Ad Account while an active token exists, the following behavior occurs:

Token Validity: The access token remains cryptographically valid and will pass the initial OAuth validation check.
  Request Outcome: When the API attempts to execute the operation against the specific Ad Account entity, the real-time ACL check will fail.
  API Response: The server will return a 403 Forbidden (or in some cases 401 Unauthorized) error, indicating that the authenticated member lacks the required role to perform the action, regardless of the rw_ads scope.

Verification Steps
To verify this boundary in a staging environment, follow these steps:

Generate an access token for a user with Account Manager permissions using the rw_ads scope.
  Successfully execute a POST or PUT request to modify a campaign.
  Change the user's role to Viewer (Read-Only) within the LinkedIn Campaign Manager UI.
  Immediately repeat the same API request using the existing token.
  Confirm that the response is a 403 Forbidden.

Diagnostic Requirement: To provide a more specific error-handling strategy, please specify if you are using a 3-legged OAuth flow (user-centric) or if you are managing tokens via a centralized integration partner system.

LinkedIn Marketing API OAuth scope boundaries for Ad Account management

Ad Account Permission Hierarchy

Configuration Uncertainty

1 answer

Permission Enforcement Logic

Real-Time Validation

Behavior During Role Downgrades

Verification Steps

Your perspective belongs here.

0 question comments