Skip to content

Asset Key Not Resolvable

URI: https://docs.ankatech.co/errors/asset-key-not-resolvable
HTTP Status: 422 Unprocessable Content

When you see this

You asked to activate a Cryptographic Exchange — activateExchange (POST /api/v3/admin/exchanges/{id}/activate) — or to resume a suspended one — resumeExchange (POST /api/v3/admin/exchanges/{id}/resume) — and the asset key the Exchange names cannot be found: either the Exchange names no key at all, or no key in your tenant carries the identifier it names. No capability can be conferred over a key that does not exist, so nothing was written and no grant was created.

The two verbs ask different questions of the key, so the same deleted key is not always this refusal:

  • At resume, the question is only whether the identifier still names a live key. When no live key carries the identifier — whether the key was deleted or never existed — the answer is this refusal.
  • At activation, the whole key tier is asked. An identifier whose only key has been deleted is answered as Key State Not Admissible — a destroyed key cannot carry a capability — and this refusal is reserved for an identifier that no key, live or deleted, has ever carried in your tenant.

This is a 422, not a 404, on purpose. The key is not something your request named — it is a reference stored on the Exchange, which resolved to a live key when the Exchange was validated and reached READY. A 404 would read as "this Exchange does not exist", when what happened is that the key the Exchange points at was deleted since.

previewExchangeActivation reports the same refusal, with the same type, inside its 200 response.

A Key ID names one key for good, so a live key that carries the identifier is the key the Exchange was validated against. Once it resolves, whether it can carry the capability is a separate question with its own types: Key State Not Admissible, Key Purpose Incompatible, Key Algorithm Incompatible and the provisioned key_ops check.

Common Causes

  • Resume: the key the Exchange references was destroyed after the Exchange was validated and no live key holds its identifier now.
  • Activation: no key — live or deleted — has ever carried the identifier the Exchange names in your tenant.
  • Either verb: the Exchange names no asset key at all.

Destroying or deleting a key revokes every Exchange that names it that has not ended, in the same transaction, so an Exchange reaching this refusal is uncommon; a revoked Exchange is refused earlier as Exchange Not Activatable or Invalid State Transition.

Response Example

{
  "type": "https://docs.ankatech.co/errors/asset-key-not-resolvable",
  "title": "Asset Key Not Resolvable",
  "status": 422,
  "detail": "Asset key 'embossing-key-visa' is no longer present in this tenant, so the capability cannot be conferred over it.",
  "instance": "/api/v3/admin/exchanges/7d2f4a10-9c31-4b8e-a5d6-2f11c0b47e93/activate",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail names the key identifier stored on your own Exchange; nothing from another tenant appears in it.

How to Resolve

The Exchange was being activated:

  1. Open the Exchange and check its asset key.
  2. Point it at a key that exists in your tenant with updateExchange. A reference change on a READY Exchange returns it to DRAFT.
  3. Validate it again with validateExchange, then activate.

The Exchange was being resumed: a suspended Exchange cannot be edited or re-validated, so it cannot be pointed at another key.

  1. Revoke it with revokeExchange.
  2. Clone it with cloneExchange — a clone is allowed from any status, REVOKED included, and starts in DRAFT with the source's references.
  3. Point the clone at a key that exists in your tenant with updateExchange, validate it with validateExchange, then activate it.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.