Skip to content

Key-Protection Backend Activation Window Lost

URI: https://docs.ankatech.co/errors/backend-activation-window-lost
HTTP Status: 409 Conflict

When you see this

A deployment key-protection backend activation (POST /api/v3/admin/platform/setup/backend/activate) stopped without recording the bind. While it ran, one of two things happened:

  • Its activation window was no longer its own. An activation keeps an activation window open and renews it at every phase. A window that makes no progress for 15 minutes is treated as abandoned and can be reclaimed by another activation — which happens when one backend call hangs that long.
  • What it read changed. The backend configuration, the credential or the declaration the activation read at its start was no longer the one standing.

The activation cannot record a bind it no longer owns. Every write of the bind is a compare-and-set under the deployment_info lock: each bootstrap tenant's key record is written only while this activation still holds its window and the configuration, credential and declaration it read are unchanged, and it is written together with the declaration naming the backend. The key's label is published only after that record commits. So the activation stopped at its next phase boundary, key record or commit, wrote nothing after losing its window, and never left a key record without its declaration. The bind was not recorded, and this refusal removes nothing: no key on the backend and no key record.

This is a 409 because the request conflicts with a change in the deployment's state during the request (RFC 9110 §15.5.10), not because anything in it was malformed.

Common Causes

  • A backend call hung — a Cloud KMS endpoint or an HSM that stopped answering without failing — for 15 minutes, and another activation reclaimed the window. Restore the backend's reachability before re-running the activation.
  • The backend configuration, credential or declaration was changed while the activation ran.

Response Example

{
  "type": "https://docs.ankatech.co/errors/backend-activation-window-lost",
  "title": "Key-Protection Backend Activation Window Lost",
  "status": 409,
  "detail": "This key-protection backend activation stopped without recording the bind: its activation window was no longer its own, or the key-protection configuration, credential or declaration it read changed while it ran. No key-encryption key was created. Re-run the activation: it reads the configuration that stands now, keeps each bootstrap tenant key already recorded for this backend, and creates or resolves by name the ones still missing. A key named in the audit record that the re-run does not use is left on the backend for you to remove.",
  "instance": "/api/v3/admin/platform/setup/backend/activate",
  "timestamp": 1787494020,
  "extensions": {
    "requestId": "2e6b9d40-71c3-4a8f-b5d2-9f04c8e1a637"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail says how many key-encryption keys the run had created or resolved on the backend before it stopped — normally none, as above. When there were some, the detail states the count, that the refused audit record names them, and that the refusal removes nothing — no key on the backend and no key record; the keys themselves are never on the response, because a key reference names your own cloud account or HSM rather than platform vocabulary.

On the environment host

init-hsm.sh <env> --activate prints the platform's detail, states that the activation contacted the backend and stopped without recording the bind, and exits 9 ("the activation was interrupted"). No bind was recorded — a bind lives only in the database — while PKCS#11 plumbing an earlier step of the same run staged (PKCS11_MODULE_PATH) stays in .env. Unlike exit 8 there is nothing to wait for. Re-run --activate.

How to Resolve

  1. Re-run the activation. It reads the configuration that stands now, keeps each bootstrap tenant key already recorded for this backend, and creates or resolves by name the ones still missing.
  2. If the detail reports keys created or resolved, read the activation's REFUSED audit record: it names each one. A key it names that the re-run does not use is left on the backend — remove it there.
  3. If a backend call hung, check the backend's reachability first — the console's Test connection control (POST /api/v3/admin/platform/setup/key-backend/test) names the cause without changing anything.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.