Skip to content

Endpoint Not Permitted

URI: https://docs.ankatech.co/errors/alert-destination-endpoint-rejected
HTTP Status: 422 Unprocessable Entity

When you see this

The outbound endpoint you supplied parsed perfectly and the platform refused the target. This is deliberately distinct from the 400 a blank or malformed URL receives: 400 means the value is not a URL, 422 means the URL is well formed and the address is not allowed. It is emitted for webhook alert destinations, which are judged strictly regardless of deployment type, and for observability backend endpoints, which are judged strictly on SaaS and permit private targets on a customer-operated install.

Common Causes

  • The endpoint does not use the https scheme, or embeds inline credentials in the form user:password@host.
  • The host is an IP literal in a loopback, private, CGNAT, link-local or multicast range.
  • The host is an IPv4 literal written in a legacy or ambiguous notation — a leading zero, hexadecimal, or fewer than four parts — that different resolvers read differently.
  • The host is an IPv6 literal that reaches an IPv4 destination through an IPv4-compatible or IPv4-transition prefix.
  • A webhook alert destination pointed at an internal address: alert destinations are always judged strictly, because a heartbeat receiver inside the network dies with the thing it is supposed to report on.

Response Example

{
  "type": "https://docs.ankatech.co/errors/alert-destination-endpoint-rejected",
  "title": "Endpoint Not Permitted",
  "status": 422,
  "detail": "the endpoint is not a permitted target",
  "instance": "/api/v3/admin/platform/alerts/destinations",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Point the endpoint at a routable, public HTTPS host with no inline credentials, written in ordinary dotted-quad or hostname form. The body names neither the rejected host nor which rule refused it, by design — naming it would turn the endpoint into a probe for what is reachable from inside the deployment.
  2. For an alert destination, use an externally reachable receiver: an internal receiver sits inside the very failure domain the alert exists to escape.
  3. Do not re-check your typing on the strength of this response. A syntax problem answers 400 under a different type; this one says the address itself is not allowed.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.