Ownership Recovery Identity Enrolled

URI: https://docs.ankatech.co/errors/ownership-recovery-identity-enrolled
HTTP Status: 409 Conflict

When you see this

Deployment-ownership recovery was run with --only-if-enrolment-required:

sudo envctl.sh <env> recover-platform-access --identity <email> --reason <text> --only-if-enrolment-required

That option asks for a recovery only while the identity is still awaiting its enrolment. The named identity has already completed its enrolment, so it was not recovered:

• its passkeys, authenticator app, recovery codes and password are untouched;
• no enrolment token was minted;
• the refusal was recorded in the audit trail;
• the command exits 3.

admin-api decides this under the identity's row lock. An enrolment that commits while the command runs is therefore the state the decision reads, and it is never wiped by a recovery that arrives a moment later.

Common Causes

• The person enrolled with an earlier token before this one was minted, so they need no new token.
• Release tooling re-minted an enrolment token for an owner who had just finished enrolling.

Response Example

{
  "type": "https://docs.ankatech.co/errors/ownership-recovery-identity-enrolled",
  "title": "Ownership Recovery Identity Enrolled",
  "status": 409,
  "detail": "The named platform identity has completed its enrolment, and this recovery was asked to recover only an identity still awaiting it, so its authenticators were kept. Nothing was changed.",
  "instance": "/api/v3/admin/platform/ownership-recovery",
  "timestamp": 1760951700,
  "extensions": {
    "requestId": "4e2a9c71-0b3d-4f58-a6e1-9d7c2b5f8e30"
  }
}

Content-Type: application/problem+json: the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId. See Error Index & Overview.

How to Resolve

1. Ask the person to sign in with the authenticator they enrolled. Nothing else is needed.
2. If they truly cannot sign in, run the break-glass recovery, which is the same command without --only-if-enrolment-required. It invalidates every authenticator of the identity and mints a new enrolment token. See Runbook: Recover platform access^*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.