Diagnose: API has not been used in project before or it is disabled

Symptom: "[SERVICE] has not been used in project [P] before or it is disabled. Enable it by visiting ... then retry."

Cause: the API is not enabled on that project. Nothing about your code or IAM is wrong yet.

Confirm:

1. Copy the API name from the error exactly (it is like storage.googleapis.com, not a friendly name).
2. gcloud services list --enabled --project [P] | grep [API] - absent confirms it.
3. Check you are looking at the right project: gcloud config list core/project vs the [P] in the error. Agents often enable the API on the wrong project.

Fix:

gcloud services enable [API] --project [P]

Then wait 1-2 minutes for propagation before retrying. Immediate retry can still fail; that is propagation, not a new problem.

If the enable call itself 403s: your identity lacks serviceusage.services.use on the project. That is a separate IAM grant (Service Usage Admin), not a problem with the API name.

Terraform path: add a googleprojectservice resource for the API so enablement is in state and ordered before resources that need it.

Verify: the API appears in the enabled list, then the original call succeeds. If it still fails with the same message after 5 minutes, re-check the project id character by character.

Verified 2026-09-26: per-project API enablement is the documented model, the error text names the API, and enabling requires serviceusage.services.use. Propagation delay is documented behavior.