Delegating access in Google API / Python -

so i've got python app running uses service account in our domain. working fine, , service account has been granted access correct scope. i'm using following lifted 1 of google examples:

from __future__ import print_function import httplib2 import os import pprint import sys  apiclient.discovery import build oauth2client.service_account import serviceaccountcredentials  """email of service account""" service_account_email = 'service_account_email@google'  """path service account's private key file""" service_account_client_file_path = 'my project-xxxxxx.json'  def main():   scopes = ['https://www.googleapis.com/auth/drive.metadata.readonly']   credentials = serviceaccountcredentials.from_json_keyfile_name(             service_account_client_file_path,             scopes=scopes         )    http = httplib2.http()    http = credentials.authorize(http)    service = build('drive', 'v3', http=http)    results = service.files().list(       pagesize=10,fields="nextpagetoken, files(id, name)").execute()   items = results.get('files', [])   if not items:       print('no files found.')   else:       print('files:')       item in items:           print('{0} ({1})'.format(item['name'], item['id']))  if __name__ == '__main__':     main() 

this retrieves documents service account. understanding should able delegate access can run user. i'm adding following line:

delegated_credentials = credentials.create_delegated("user.name@org_domain.org.au") 

and using deletegated_credentials when authorizing. @ point i'm getting error

oauth2client.client.httpaccesstokenrefresherror: access_denied: requested client not authorized.

so assumption user i'm specifying doesn't have access api. correct approach or missing obvious?

found mistake, posting here future generations. scope in python code incorrect, didn't realise needed match scope granted in admin client exactly!

the scope in admin client follows;

https://www.googleapis.com/auth/admin.reports.audit.readonly https://www.googleapis.com/auth/drive

and scope in code now;

scopes = ['https://www.googleapis.com/auth/admin.reports.audit.readonly','https://www.googleapis.com/auth/drive'] 

i know don't need reports scope, point if not match won't work.

rookie mistake!