Skip to content

Backend Key Provisioning Failed

URI: https://docs.ankatech.co/errors/backend-kek-provisioning-failed
HTTP Status: 422 Unprocessable Entity

When you see this

Activation of the deployment key-protection backend passed the wrap/unwrap round trip and then failed while creating a per-tenant key-encryption key. The backend proved itself and then declined, or failed, to create a key. The failing capability class is create-key, and extensions.reason carries the closed self-test vocabulary. The deployment was not activated and its declared backend is unchanged.

Common Causes

  • The credential is granted encrypt and decrypt but not key creation, so it passes the self-test and fails this phase.
  • The backend refused the creation, was unreachable, or timed out (REFUSED, UNREACHABLE, TIMED_OUT).
  • A quota, key-ring or resource-policy constraint on the cloud account blocked the new key.

Response Example

{
  "type": "https://docs.ankatech.co/errors/backend-kek-provisioning-failed",
  "title": "Backend Key Provisioning Failed",
  "status": 422,
  "detail": "The deployment key-protection backend answered a wrap/unwrap round trip but did not complete per-tenant key-encryption-key provisioning. The failing capability class is create-key. The deployment was not activated and its declared backend is unchanged.",
  "instance": "/api/v3/admin/platform/setup/backend/activate",
  "timestamp": 1730000000,
  "extensions": {
    "reason": "REFUSED",
    "requestId": "1c4b8e60-7f2a-4d31-95ab-2e60f4d7c018"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Grant the credential the key-creation permission on the target key ring or vault. The round trip already proved wrap and unwrap, so widening the encrypt/decrypt policy is the wrong change.
  2. Read extensions.reason to tell a permission refusal apart from a transport or timeout condition.
  3. Re-run POST /api/v3/admin/platform/setup/backend/activate. Keys the failed attempt already created are adopted without the backend being contacted for them, and they are named on the failure audit row, so a partial run leaves nothing orphaned.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.