GCP API Not Enabled Error: Fix SERVICE_DISABLED (403)

Diagnose the problem in 30 seconds

Quick fix

gcloud services enable sqladmin.googleapis.com --project=PROJECT_ID

Replace PROJECT_ID with the project where the error occurred. Wait about 60 seconds for propagation, then retry your operation. That is usually all you need.

If you are not sure which project your gcloud CLI is targeting, check:

gcloud config get project

Simple explanation

Every Google Cloud project starts with most APIs turned off. Before you can use a service like Cloud SQL, BigQuery, or Cloud Run, you need to enable its API for that specific project.

This is a per-project setting, not a per-user setting. The same user account or service account can work perfectly in Project A (where the API is enabled) and fail in Project B (where it is not). That catches people off guard when they start working across multiple projects.

For the full picture of how the API activation model works and which APIs are enabled by default, see Google Cloud APIs Explained.

What the error looks like

The error message is distinctive. It names the specific API and includes a direct link to enable it:

Error 403: Cloud SQL Admin API has not been used in project my-project
before or it is disabled. Enable it by visiting
https://console.developers.google.com/apis/api/sqladmin.googleapis.com/overview?project=my-project
then retry. If you enabled this API recently, wait a few minutes for the action
to propagate to our systems and retry.

The key clues in this message are:

• The API name: sqladmin.googleapis.com appears in the URL. This is the identifier you pass to gcloud services enable.
• The project reference: my-project tells you which project is affected. Confirm this is the project you intended.
• The activation link: clicking it opens the Cloud Console directly to the enable page.
• The propagation note: Google includes this because enablement is not instant.

SERVICE_DISABLED vs PERMISSION_DENIED

Both errors return HTTP 403, which makes them easy to confuse. Here is how to tell them apart:

If you are troubleshooting an IAM error instead, see GCP Permission Denied Errors or IAM AccessDenied Fixes for a walkthrough.

How to fix it

Enable the API in the Console

1. Open the Cloud Console.
2. Select the correct project from the project picker at the top of the page.
3. Go to APIs & Services > Library.
4. Search for the API name (for example, “Cloud SQL Admin API”).
5. Click Enable.
6. Wait about 60 seconds before retrying your operation.

Alternatively, click the enable link directly from the error message. It takes you straight to the right page.

Enable the API with gcloud

# Enable a single API
gcloud services enable sqladmin.googleapis.com

# Enable multiple APIs at once
gcloud services enable \
  sqladmin.googleapis.com \
  run.googleapis.com \
  cloudbuild.googleapis.com \
  artifactregistry.googleapis.com

# Always specify the project explicitly when managing multiple projects
gcloud services enable sqladmin.googleapis.com \
  --project=my-project-id

# Verify the API is now enabled
gcloud services list --enabled --filter="name:sqladmin.googleapis.com"

# List all enabled APIs for the current project
gcloud services list --enabled

Using —project=PROJECT_ID explicitly is safer than relying on your gcloud config default, especially if you switch between projects. For the full guide to enabling APIs, see How to Enable APIs in GCP.

Enable required APIs with Terraform

Declaring APIs in Terraform makes your project setup reproducible and prevents the “API not enabled” surprise when someone deploys to a new project:

# apis.tf
locals {
  required_apis = [
    "compute.googleapis.com",
    "container.googleapis.com",
    "run.googleapis.com",
    "cloudbuild.googleapis.com",
    "artifactregistry.googleapis.com",
    "sqladmin.googleapis.com",
    "secretmanager.googleapis.com",
    "monitoring.googleapis.com",
    "logging.googleapis.com",
  ]
}

resource "google_project_service" "apis" {
  for_each = toset(local.required_apis)

  project = var.project_id
  service = each.value

  # Prevent Terraform from disabling APIs on terraform destroy
  disable_on_destroy = false
}

Common situations where this happens

You will most often hit this error when working in a project where the service has never been used before. Here are the scenarios that catch people most:

• Deploying to Cloud Run: needs run.googleapis.com, and often cloudbuild.googleapis.com and artifactregistry.googleapis.com for building and storing images.

• Pushing images to Artifact Registry: needs artifactregistry.googleapis.com.

• Connecting to Cloud SQL: needs sqladmin.googleapis.com, plus servicenetworking.googleapis.com if using private IP.

• Running BigQuery queries: needs bigquery.googleapis.com.

• Creating GKE clusters: needs container.googleapis.com.

• Publishing to Pub/Sub: needs pubsub.googleapis.com.

• Configuring private IP or VPC peering: needs servicenetworking.googleapis.com.

When to use this guide

This page is for you if:

• You got a 403 error during your first deployment to a new project
• Terraform fails while creating resources with “API not enabled” in the error
• A service account works in one project but gets 403 in another
• A Google client library throws an error saying the API is disabled
• You see a console URL in the error message that says “enable it by visiting”

If the error references a specific permission name (not an API name), head to the permission denied guide instead. If the error is about authentication rather than authorization, see troubleshooting authentication errors.

Prevent this in new projects

The fastest way to avoid API-not-enabled errors is to enable every API you need as part of project setup, before you deploy anything. Chasing APIs one at a time as errors pop up turns a five-minute deployment into a frustrating cycle of enable-wait-retry.

A simple shell script handles this for new projects:

#!/bin/bash
PROJECT_ID="my-new-project"
gcloud config set project $PROJECT_ID

gcloud services enable \
  compute.googleapis.com \
  container.googleapis.com \
  run.googleapis.com \
  cloudfunctions.googleapis.com \
  cloudbuild.googleapis.com \
  artifactregistry.googleapis.com \
  sqladmin.googleapis.com \
  secretmanager.googleapis.com \
  monitoring.googleapis.com \
  logging.googleapis.com \
  iam.googleapis.com \
  iamcredentials.googleapis.com \
  serviceusage.googleapis.com \
  cloudresourcemanager.googleapis.com

echo "APIs enabled for $PROJECT_ID"