Manual review request: 403 Lightning dunning decision is deny

Gemini API
1

Hello Google AI / Gemini Team,

We are long-standing Google Cloud users with a flawless payment history. Since August 1st, we have been facing a critical issue where a billing banner appeared in our GCP Console (“Your payment information could not be processed…”), causing all Vertex AI and Gemini API calls to fail with:

403 PERMISSION_DENIED: Lightning dunning decision is deny for project: projects/...

Context & Steps Already Taken:

  • We have been in active contact with GCP Cloud Billing Support all week.

  • Billing Support explicitly confirmed that our billing account is 100% active, healthy, and in good standing with zero outstanding balances.

  • We successfully completed multiple manual payments this week to prove card validity and trigger system updates.

  • GCP Support confirmed everything is regularized on their end, indicating this is a known backend synchronization bug where the internal “Lightning” security engine remains stuck on DENY despite clean billing records.

Since Cloud Billing cannot directly reset the API-level Lightning flags, we kindly ask a forum admin or engineer to manually review and lift the dunning block for our affected projects.

List of Affected GCP Project Numbers:

  • 353583524..

  • 5831166930..

  • 8061496851..

  • 7469536452..

  • 4395957772..

  • 1497524363..

  • 8719656334..

  • 6622669491..

  • 5259808870..

  • 7049605851..

  • 1933901821..

  • 4034898885..

  • 2699754538..

  • 8969500176..

  • 9617755460..

  • 6178971584..

  • 8906974111..

Thank you for your help in resolving this service disruption!

2

I found a workaround to fix the 403 “Lightning dunning decision is deny for project” error.

Google Billing Support indicated that this issue stems from a backend API service decision rather than a traditional billing suspension, which explains why accounts look active despite requests being blocked. Performing a billing account re-link cycle resets this status and restores API access immediately.

Workaround Steps

  1. Create a new Billing Account in Google Cloud Console.
  2. Link the affected GCP project to this new Billing Account.
  3. Re-link the GCP project back to your original Billing Account (if you want to preserve your billing history).

*Note: This immediately resolves the 403 API errors, but it does not clear the warning message: "Your payment information could not be processed. Visit the payment overview page to take action on your account to prevent service disruption."*

Automated Bash Script

Pass your PROJECT_ID and your newly created NEW_BILLING_ACCOUNT_ID as arguments:

#!/usr/bin/env bash
set -euo pipefail

if [[ $# -ne 2 ]]; then
  echo "Usage: $0 PROJECT_ID NEW_BILLING_ACCOUNT_ID" >&2
  exit 1
fi

PROJECT_ID="$1"
NEW_BILLING_ACCOUNT="$2"

echo "Fetching current billing account for project '$PROJECT_ID'..."
OLD_BILLING_ACCOUNT=$(gcloud billing projects describe "$PROJECT_ID" \
  --format="value(billingAccountName)" | sed 's|billingAccounts/||')

if [[ -z "$OLD_BILLING_ACCOUNT" ]]; then
  echo "Error: No billing account associated with project '$PROJECT_ID'." >&2
  exit 1
fi

echo "Current billing account: $OLD_BILLING_ACCOUNT"
echo "Switching to new billing account '$NEW_BILLING_ACCOUNT'..."
gcloud billing projects link "$PROJECT_ID" --billing-account "$NEW_BILLING_ACCOUNT"
echo "Switch completed."

echo "Reverting to original billing account '$OLD_BILLING_ACCOUNT'..."
gcloud billing projects link "$PROJECT_ID" --billing-account "$OLD_BILLING_ACCOUNT"
echo "Done. Project '$PROJECT_ID' is re-linked to '$OLD_BILLING_ACCOUNT'."

Hopefully this helps anyone who is currently blocked while waiting for a permanent fix from Google Support.

3

Thanks for posting this — it’s the clearest explanation of the failure mode I’ve found.

Before I try the re-link cycle on a production project: did you notice any effect on the original billing account afterwards? Specifically, were any promotional credits, discounts or billing history attached to the original account affected by unlinking and re-linking the project, or did everything carry over untouched?

Also, roughly how long after the re-link did API access come back?