Skip to content

Key Protection Backend Already Bound

URI: https://docs.ankatech.co/errors/backend-already-bound
HTTP Status: 409 Conflict

When you see this

A deployment-plane operation tried to change the platform's declared key-protection backend after that backend was already bound. Backend declaration is changeable only until the bind: once the host has bound the backend and the bootstrap tenant KEKs exist, the declared backend is immutable, and the request is rejected before any mutation and before any audit event is emitted.

Common Causes

  • Re-running POST /api/v3/admin/platform/setup/backend/declare on an environment whose backend is already bound.
  • Replacing the deployment backend configuration through PUT /api/v3/admin/platform/setup/backend/configuration after key material has been wrapped under the existing backend.
  • Calling POST /api/v3/admin/platform/setup/backend/activate on a platform already bound to a different backend — the conflict is evaluated first, so no credential is unsealed and no connection is opened.

Response Example

{
  "type": "https://docs.ankatech.co/errors/backend-already-bound",
  "title": "Key protection backend already bound",
  "status": 409,
  "detail": "The key-protection backend is already bound and can no longer be changed. Changing it requires destroying and recreating the environment.",
  "instance": "/api/v3/admin/platform/setup/backend/declare",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the current declaration with GET /api/v3/admin/platform/setup/backend/configuration to confirm which backend is in force.
  2. If the bound backend is the intended one, no action is required — the refusal protects the key material already wrapped under it.
  3. If a different backend is genuinely required, destroy and recreate the environment; re-pointing a bound backend orphans the existing key material permanently and is not recoverable through this API.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.