Enabling APIs fails with 403: you need serviceusage.services.use

TL;DR

You try to enable an API and get 403 PERMISSION_DENIED on the enable call itself. Your identity needs the serviceusage.services.use permission on the project (roles/serviceusage.serviceUsageAdmin includes it, or serviceusage.serviceUsageConsumer for use without admin).

Steps

1. Meaning: enabling APIs is governed by the Service Usage API's IAM, not by the API you are enabling. Your identity needs the serviceusage.services.use permission on the project (roles/serviceusage.serviceUsageAdmin includes it, or serviceusage.serviceUsageConsumer for use without admin).
2. Fix:
3. Confirm the denied permission in the error: it names serviceusage.services.use.
4. Have someone with project IAM admin grant you roles/serviceusage.serviceUsageAdmin on the project (or a narrower custom role).
5. Retry the enable.
6. Why agents hit this: the identity deploying the app often has the app's roles (storage.admin etc) but nobody granted service usage rights. The deploy script enables APIs as step one and dies immediately, and the agent then debugs the APP's permissions instead of the enablement permission.
7. Related: the same permission gates gcloud services list in some paths. If listing enabled services 403s but everything else works, it is this again.
8. Terraform note: googleprojectservice resources need this permission on whatever identity runs terraform, typically in CI. Grant it to the CI service account, not just to humans.
9. Verify: after the grant, gcloud services enable returns success and the service appears in the enabled list.

When to use

You are seeing this: Meaning: enabling APIs is governed by the Service Usage API's IAM, not by the API you are enabling. Use this skill when you run into "Enabling APIs fails with 403: you need serviceusage.services.use".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26: per the Service Usage IAM docs, enabling APIs requires serviceusage.services.use, which is separate from the target API's roles. This is the documented fix for 403s on the enable call itself.