Administrator Credential Not Admitted

URI: https://docs.ankatech.co/errors/administrator-credential-not-admitted
HTTP Status: 400 Bad Request

When you see this

A tenant provisioning request (POST /api/v3/admin/platform/tenants/provision, operation provisionPlatformTenant) carried adminPassword or requirePasswordChange, and the caller may not choose the first administrator's credential. extensions.member names the refused member. Nothing was created: no tenant, no identity, no membership.

A tenant's first administrator is invited: a new address receives a PENDING membership and, once the tenant is activated, an activation link, and an existing identity receives a PENDING membership and keeps its own authenticators. The administrator sets their own credentials. The two members exist for one case only: a platform administrative workload on a development deployment (an environment created with create-env.sh --app-env dev), where seeding scripts provision demonstration tenants unattended. GET /api/v3/admin/platform/deployment-info states it in workloadAdministratorPasswordAdmitted.

Common Causes

• A provisioning script or tool still sends an initial administrator password to hand over out of band.
• The request sets requirePasswordChange, to either value.
• A script written for a development deployment runs unchanged against a production or customer deployment.

Response Example

{
  "type": "https://docs.ankatech.co/errors/administrator-credential-not-admitted",
  "title": "Administrator Credential Not Admitted",
  "status": 400,
  "detail": "'adminPassword' is not accepted: the tenant's first administrator is invited and sets their own credentials. Only a platform workload on a development deployment may send adminPassword or requirePasswordChange; omit both.",
  "instance": "/api/v3/admin/platform/tenants/provision",
  "timestamp": 1757886300,
  "extensions": {
    "requestId": "8d3b2a1c-5e6f-4a7b-9c8d-1e2f3a4b5c6d",
    "member": "adminPassword"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail never carries a submitted value.

How to Resolve

1. Remove adminPassword and requirePasswordChange from the request.
2. Send the request again, then activate the tenant. The administrator receives the activation link and sets their own credentials; see Tenant Management^*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.