How can I grant the account permission to list enabled APIs?

To list the services available, you need the permission services.list. You can grant this permission via granting a role that includes said permission, like roles/serviceusage.serviceUsageViewer, or you can create your own personalised role with that permission only, if you wish to.

On how to enable the API: First check if said account has or hasn't said API enabled, which looks unlikely, with $ gcloud services list. By default, it shows all the enabled services for said account.

If you can't see 'appengineflex.googleapis.com' in said list, you can run $ gcloud services enable appengineflex.googleapis.com to do so.