Administrator Credential Not Admitted

URI: https://docs.ankatech.co/errors/administrator-credential-not-admitted
HTTP Status: 400 Bad Request

When you see this

A tenant provisioning request (POST /api/v3/admin/platform/tenants/provision, operation provisionPlatformTenant) carried adminPassword or requirePasswordChange, and the caller may not choose the first administrator's credential. extensions.member names the refused member. Nothing was created: no tenant, no identity, no membership.

A tenant's first administrator is invited: a new address receives an activation link and a PENDING membership, and an existing identity receives a PENDING membership and keeps its own authenticators. The administrator sets their own credentials. The two members exist for one case only: a platform administrative workload on a development deployment (an environment created with create-env.sh --app-env dev), where seeding scripts provision demonstration tenants unattended. GET /api/v3/admin/platform/deployment-info states it in workloadAdministratorPasswordAdmitted.

Common Causes

• A provisioning script or tool still sends an initial administrator password to hand over out of band.
• The request sets requirePasswordChange, to either value.
• A script written for a development deployment runs unchanged against a production or customer deployment.

Response Example

{
  "type": "https://docs.ankatech.co/errors/administrator-credential-not-admitted",
  "title": "Administrator Credential Not Admitted",
  "status": 400,
  "detail": "'adminPassword' is not accepted: the tenant's first administrator is invited and sets their own credentials. Only a platform workload on a development deployment may send adminPassword or requirePasswordChange; omit both.",
  "instance": "/api/v3/admin/platform/tenants/provision",
  "timestamp": 1757886300,
  "extensions": {
    "requestId": "8d3b2a1c-5e6f-4a7b-9c8d-1e2f3a4b5c6d",
    "member": "adminPassword"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail never carries a submitted value.

How to Resolve

1. Remove adminPassword and requirePasswordChange from the request.
2. Send the request again. The administrator receives the activation link and sets their own credentials; see Tenant Management^*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.