Skip to content

Key Protection Backend Not Bound

URI: https://docs.ankatech.co/errors/backend-not-bound
HTTP Status: 503 Service Unavailable

When you see this

An operation reached the deployment-plane key-protection seam while this environment's key-protection backend is not bound and ready. Deployment secret custody seals under the deployment KEK, so with no bound backend nothing can be sealed and the operation fails closed: no envelope row is written, and nothing is stored unsealed as a fallback.

Common Causes

  • The environment is still in SETUP_REQUIRED — the backend has been declared but first-run provisioning has not bound it.
  • No key-protection backend is available to this instance, so no deployment KEK can be resolved.
  • The deployment KEK could not be created or fetched from the backend.
  • The secret-custody token layer is missing, uninitialised or unreachable, or a generated KEK did not persist.

Response Example

{
  "type": "https://docs.ankatech.co/errors/backend-not-bound",
  "title": "Key protection backend not bound",
  "status": 503,
  "detail": "The key-protection backend for this environment is not bound and ready. Please retry once it has been provisioned.",
  "instance": "/api/v3/admin/platform/observability/backends",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "a71e0c33-5b48-4f9e-8c21-b6d40e7a2915"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Check first-run state with GET /api/v3/admin/platform/setup/status.
  2. Complete host-side backend provisioning for this environment, then run POST /api/v3/admin/platform/setup/complete.
  3. Retry the original request once the backend reports bound. The refused call persisted nothing, so the retry is safe.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.