Skip to content

Key-Encryption Key Not Retired

URI: https://docs.ankatech.co/errors/kek-destruction-not-retired
HTTP Status: 409 Conflict

When you see this

A platform administrator asked to destroy one of a tenant's retired key-encryption keys at the provider or HSM that holds it, and the request was refused. The key keeps its status, the provider was not asked to destroy anything, and the refusal is recorded in the audit trail as DENIED.

A tenant key-encryption key is destroyed at its provider or HSM, never only in the platform's records. A destruction request moves a RETIRED key to PENDING_DESTRUCTION and calls no provider: the platform holds the destruction for the deployment's waiting period (30 days by default), and until it ends a cancel returns the key to RETIRED with no provider call. When the period ends the platform checks the key again and only then asks its provider or HSM to destroy it; the key becomes DESTROYED only once a read of the provider confirms it gone. Until then the destruction can be cancelled while the key object still exists, which returns the key to RETIRED.

Common Causes

  • The key is ACTIVE: the tenant still wraps new key material under it.
  • The key is SUPERSEDED: an online rotation is still re-wrapping key material away from it.
  • The key is REVOKED: the platform gave up its custody when the tenant moved to another carrier, so it is not the platform's to destroy.

Response Example

{
  "type": "https://docs.ankatech.co/errors/kek-destruction-not-retired",
  "title": "Key-Encryption Key Not Retired",
  "status": 409,
  "detail": "Only a retired key-encryption key can be destroyed. Nothing was changed.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/keks/3c1f7a9e-2b44-4e0d-8f6a-91d2c7b5e0aa/destroy",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the tenant's key custody and its key-encryption key lineage: each entry's status and destructionEligible say whether it can be destroyed now.
  2. A key becomes RETIRED once nothing is wrapped under it: after a rotation completes, or after a custody move leaves it. Ask again then.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.