Skip to content

Backend Self-Test Failed

URI: https://docs.ankatech.co/errors/backend-selftest-failed
HTTP Status: 422 Unprocessable Entity

When you see this

A deployment key-protection backend command was attempted, the backend or the platform's own routing answered, and the wrap/unwrap round trip did not complete under the supplied credential. The command has a postcondition that was not reached, so it refuses instead of returning a verdict inside a 200 body. extensions.reason carries the closed self-test vocabulary, which can never contain an ARN, resource path, vault URL, region, account id or vendor message.

Common Causes

  • The backend refused the supplied credential (REFUSED), or the endpoint could not be reached (UNREACHABLE, TIMED_OUT).
  • A rotation or restore candidate reaches a different key-encryption key than the credential in effect, so the cross-credential round trip did not reproduce what it wrapped (ROUND_TRIP_MISMATCH).
  • The recorded descriptor cannot support a round trip (DESCRIPTOR_INVALID), or routing to the backend was unavailable (ROUTING_UNAVAILABLE).

Response Example

{
  "type": "https://docs.ankatech.co/errors/backend-selftest-failed",
  "title": "Backend Self-Test Failed",
  "status": 422,
  "detail": "The deployment key-protection backend did not complete a wrap/unwrap round trip under the supplied credential. The credential in effect is unchanged and nothing was activated.",
  "instance": "/api/v3/admin/platform/setup/backend/credential",
  "timestamp": 1730000000,
  "extensions": {
    "reason": "ROUND_TRIP_MISMATCH",
    "requestId": "6b3f9a12-84c7-4d0e-b5a3-71f2c8d94e60"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read extensions.reason — it separates a rejected credential from an unreachable endpoint and from a candidate that reaches the wrong key.
  2. Correct the credential or the backend coordinates and re-submit. The live sealed credential is never written before the round trip returns, so the credential in effect is unchanged and the transient candidate has been deleted.
  3. Rehearse coordinates with POST /api/v3/admin/platform/setup/backend/validate before committing them again.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.