Skip to content

Break-Glass Designation Ineligible

URI: https://docs.ankatech.co/errors/break-glass-designation-ineligible
HTTP Status: 422 Unprocessable Entity

When you see this

A break-glass identity signs in only with its own security keys, through the emergency-access entry, is dedicated to one scope and holds no identity provider link. The request would break one of those rules, so it was refused and nothing was changed.

It answers two kinds of request:

  • Designating a membership (PUT …/users/{userId}/break-glass-designation on the tenant or the platform plane) that cannot be a break-glass identity.
  • A write on a membership that is designated: declaring a federated link intent on it, or restricting it to the identity provider (authenticationPath: FEDERATED_ONLY).

One problem answers every reason, and the answer never names another tenant: a tenant administrator does not learn from it that a member belongs to another organisation.

Common Causes

  • The member holds a link to an identity provider.
  • The member is restricted to the identity provider by its authentication path.
  • The member's account also belongs to another tenant, or to the platform.
  • The membership is already designated, and the request would link it or restrict it to the identity provider.

Response Example

{
  "type": "https://docs.ankatech.co/errors/break-glass-designation-ineligible",
  "title": "Break-Glass Designation Ineligible",
  "status": 422,
  "detail": "This membership cannot be designated for break-glass access: a break-glass identity signs in only with its own security keys, is dedicated to one scope and holds no identity provider link. Nothing was changed.",
  "instance": "/api/v3/admin/tenants/8d2f1c4e-3b7a-4e91-a6d5-0c9f2e8b7a14/users/3f2b8c1e-6d4a-4f7b-9c2e-1a5d8e7f9b30/break-glass-designation",
  "timestamp": 1760951700,
  "extensions": {
    "requestId": "4e2a9c71-0b3d-4f58-a6e1-9d7c2b5f8e30"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Designate an account that exists only for emergency access in this scope: no identity provider link, no restriction to the identity provider, no membership anywhere else.
  2. To link or restrict a designated member, clear its designation first. Keep at least one other ready break-glass identity when the scope signs in through the identity provider only.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.