Skip to content

Break-Glass Session Cannot Delegate

URI: https://docs.ankatech.co/errors/break-glass-session-cannot-delegate
HTTP Status: 403 Forbidden

When you see this

A Cryptographic Playground run was requested from a break-glass session, a session opened through the emergency-access entry whose access token carries break_glass: true. An emergency way in never runs an operation as an Actor, on any deployment type, so the run was refused before any token was requested and nothing ran. The refusal is recorded in the audit trail.

Returned by POST /api/v3/admin/tenants/{tenantId}/crypto-playground/execute (executeCryptoPlaygroundOperation).

Common Causes

  • You are still signed in through emergency access and opened the Cryptographic Playground to try an operation.

Response Example

{
  "type": "https://docs.ankatech.co/errors/break-glass-session-cannot-delegate",
  "title": "Break-Glass Session Cannot Delegate",
  "status": 403,
  "detail": "A break-glass session cannot run an operation as an Actor; nothing was run. Sign in normally to run it.",
  "instance": "/api/v3/admin/tenants/8d2f1c4e-3b7a-4e91-a6d5-0c9f2e8b7a14/crypto-playground/execute",
  "extensions": {
    "requestId": "7c9e6679-7425-40de-944b-e07fc1f90ae7"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Sign out of the break-glass session.
  2. Sign in normally as a tenant administrator or key manager of the tenant.
  3. Run the operation again from the Cryptographic Playground.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.