Skip to content

Key Belongs to the Platform

URI: https://docs.ankatech.co/errors/byok-key-is-platform-key
HTTP Status: 422 Unprocessable Entity

When you see this

A tenant's own key-protection backend (BYOK) names a key this deployment created or uses for its own key custody. A tenant's own backend must hold a key the tenant's organization created and controls, so the request is refused. It is answered, on the tenant plane and to a platform administrator acting on the tenant's behalf, only after the submitted credential has proven access to the declared key:

  • binding the declared backend, once the credential's verification passed: nothing is bound;
  • opening a key custody move to the tenant's own key, or changing a move's destination to it, once the round trip with the destination key succeeded: nothing is recorded.

A credential that fails its verification gets that verification's own refusal, never this type. The tenant's key protection is exactly as it was before the request. Declaring or changing the backend, validating or testing the declaration, updating its credential and deleting it do not return this type.

Submitting the same declaration gives the same answer, so the response is not retryable as it stands.

Response Example

{
  "type": "https://docs.ankatech.co/errors/byok-key-is-platform-key",
  "title": "Key belongs to the platform",
  "status": 422,
  "detail": "The declared key is one this deployment uses for its own key custody. Declare a key your organization created and controls.",
  "instance": "/api/v3/admin/tenants/7d1c9b40-52e8-4a36-9f07-c3b81e6d240a/key-backend/byok/bind",
  "extensions": {
    "requestId": "5b2e8c14-9d3a-4f61-8a07-e4c92b1d6f38"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The response carries no Retry-After header: the refusal lasts until a different key is declared.

The detail is fixed: it names no key, account, project, vault or credential field. The refusal is recorded in the audit trail as denied, naming the tenant and the backend.

How to Resolve

  1. Create a key in your own account, project or vault: an AWS KMS key, a Google Cloud KMS CryptoKey, or an Azure Key Vault or Managed HSM key that your organization controls.
  2. Declare that key, and bind the backend or open the move again.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.