Skip to content

Assisted Recovery In Progress

URI: https://docs.ankatech.co/errors/assisted-recovery-in-progress
HTTP Status: 409 Conflict

When you see this

An administrator asked to re-send a person's activation link while that person is completing an assisted recovery. The recovery invalidated every authenticator the person held and handed over a single-use enrolment token; only that token completes the recovery. An activation link would let whoever reads the person's mailbox replace the authenticator the enrolment establishes, so none is issued until the enrolment completes.

Common Causes

  • The person's membership in this tenant is still pending. A platform recovery authority performed an assisted recovery of the person, and an administrator of a tenant where the person has not yet accepted the membership tried to re-send its activation link.
  • The enrolment token has not been used yet. The person has not opened the console with the token the recovery authority handed over.

Response Example

{
  "type": "https://docs.ankatech.co/errors/assisted-recovery-in-progress",
  "title": "Assisted Recovery In Progress",
  "status": 409,
  "detail": "This person is completing an assisted recovery and enrols through the enrolment token the recovery handed over; no activation or password-reset link is sent until that enrolment completes.",
  "instance": "/api/v3/admin/tenants/123e4567-e89b-12d3-a456-426614174000/users/7c9e6679-7425-40de-944b-e07fc1f90ae7/regenerate-activation-token",
  "timestamp": 1765128600,
  "extensions": {
    "requestId": "3f1c2a9e-4b7d-4e2a-9c11-0a2b3c4d5e6f"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail is one fixed sentence for every person in this state. Nothing is sent, and any outstanding link is left as it was.

How to Resolve

  1. Do not retry the re-send: it is refused for as long as the recovery is open.
  2. Make sure the person has the enrolment token from the platform recovery authority and opens the console with it. Once their new authenticator is enrolled, they sign in normally and no activation link is needed.
  3. If the enrolment token expired unused, ask the platform recovery authority to perform the recovery again; it hands over a new token.

An invitation of a person in this state is not refused: it creates the pending membership exactly as for any other address and sends no link, so the inviting tenant learns nothing about the person's account. The re-send issues the link once the recovery is complete.