Skip to content

Break-Glass Session Cannot Change Designation

URI: https://docs.ankatech.co/errors/break-glass-session-cannot-change-designation
HTTP Status: 403 Forbidden

When you see this

A break-glass designation was set or cleared from a break-glass session — a session opened through the emergency-access entry, whose access token carries break_glass: true. The emergency session never decides who may enter by break-glass, its own designation included, so the request was refused before anything was read, nothing changed, and the refusal was recorded in the audit trail as DENIED.

It answers both planes: the tenant designation (PUT /api/v3/admin/tenants/{tenantId}/users/{userId}/break-glass-designation) and the platform designation (PUT /api/v3/admin/platform/users/{userId}/break-glass-designation). Removing from the scope a member who holds a designation deletes that designation, so a break-glass session's removal of a designated member is refused with the same problem type, before the member is removed.

Common Causes

  • You are still signed in through emergency access and tried to designate another member, or to clear a designation, from the same session.
  • You tried to clear your own designation while signed in through it.
  • You tried to remove a designated member from the tenant or the platform while signed in through emergency access.

Response Example

{
  "type": "https://docs.ankatech.co/errors/break-glass-session-cannot-change-designation",
  "title": "Break-Glass Session Cannot Change Designation",
  "status": 403,
  "detail": "A break-glass session cannot change a break-glass designation. Sign in normally to change it. Nothing was changed.",
  "instance": "/api/v3/admin/tenants/8d2f1c4e-3b7a-4e91-a6d5-0c9f2e8b7a14/users/3f2b8c1e-6d4a-4f7b-9c2e-1a5d8e7f9b30/break-glass-designation",
  "timestamp": 1760951700,
  "extensions": {
    "requestId": "4e2a9c71-0b3d-4f58-a6e1-9d7c2b5f8e30"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Sign out of the break-glass session.
  2. Sign in normally as an administrator who holds the permission to manage break-glass designations in that scope.
  3. Set or clear the designation, or remove the member, from that normal session.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.