Authentication Policy Unreadable

URI: https://docs.ankatech.co/errors/authentication-policy-unreadable
HTTP Status: 503 Service Unavailable

When you see this

The authentication policy that governs the operation could not be read: a stored tenant authentication posture, or the deployment's allowance of sign-in methods and passkey properties, holds a value the running release does not know. The operation is refused rather than decided on a weaker policy, because reading an unknown value as absent would drop a requirement the tenant set. Nothing was changed.

Admin API answers it on:

• the tenant authentication posture, read and write (getTenantAuthenticationPosture, replaceTenantAuthenticationPosture, /api/v3/admin/tenants/{tenantId}/authentication-posture);
• the passkey registration options the sign-in service requests on a person's behalf, when the policy of a tenant the passkey is registered for cannot be read.

A person never receives this type: the sign-in transaction and the Security page answer it as their own dependency failure, and a sign-in whose policy cannot be read is refused.

This is not dependency-not-ready: that answer is transient and carries Retry-After, while this one lasts until the stored value is readable. It carries no Retry-After, and the detail names neither the stored row nor the value; the Admin API log does.

Common Causes

• The deployment runs an earlier release than the one that wrote the posture, for example after an upgrade was rolled back, and the posture uses a sign-in method or passkey property the earlier release does not know.
• A posture row was edited in the database outside the API.

Response Example

{
  "type": "https://docs.ankatech.co/errors/authentication-policy-unreadable",
  "title": "Authentication Policy Unreadable",
  "status": 503,
  "detail": "The authentication policy that governs this operation holds a value this release cannot read, so the operation is refused rather than decided on a weaker policy. Nothing was changed.",
  "instance": "/api/v3/admin/tenants/8d2f1c4e-3b7a-4e91-a6d5-0c9f2e8b7a14/authentication-posture",
  "timestamp": 1760710800,
  "extensions": {
    "requestId": "e2a94c61-7f3b-4d85-b0c2-9e6a1d8f4b37"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

1. Do not retry: the same request is refused until the stored value is readable.
2. Find the row the Admin API log names for the requestId.
3. Run the release that wrote the value, or have a platform administrator replace the tenant's posture with values the running release accepts.

See Passkeys and the Relying Party ID and Admin API endpoints — Authentication posture.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.