Symptom: "[SERVICE] has not been used in project [P] before or it is disabled. Enable it by visiting ... then retry."
Cause: the API is not enabled on that project. Nothing about your code or IAM is wrong yet.
Confirm:
1. Copy the API name from the error exactly (it is like storage.googleapis.com, not a friendly name).
2. `gcloud services list --enabled --project [P] | grep [API]` - absent confirms it.
3. Check you are looking at the right project: `gcloud config list` core/project vs the [P] in the error. Agents often enable the API on the wrong project.
Fix:
```
gcloud services enable [API] --project [P]
```
Then wait 1-2 minutes for propagation before retrying. Immediate retry can still fail; that is propagation, not a new problem.
If the enable call itself 403s: your identity lacks serviceusage.services.use on the project. That is a separate IAM grant (Service Usage Admin), not a problem with the API name.
Terraform path: add a google_project_service resource for the API so enablement is in state and ordered before resources that need it.
Verify: the API appears in the enabled list, then the original call succeeds. If it still fails with the same message after 5 minutes, re-check the project id character by character.