Skip to content

Break-Glass Session Cannot Recover Identity

URI: https://docs.ankatech.co/errors/break-glass-session-cannot-recover-identity
HTTP Status: 403 Forbidden

When you see this

An assisted recovery of an identity (POST /api/v3/admin/platform/identity-recoveries) was requested from a break-glass session — a session opened through the emergency-access entry, whose access token carries break_glass: true. The emergency session never takes over an account: a recovery hands its caller an enrolment token that becomes a normal session as the recovered identity, and deletes that identity's break-glass designation, so from a break-glass session it would turn one emergency entry into another person's ordinary access. The request was refused before anything was read, nothing changed, and the refusal was recorded in the audit trail as DENIED.

Common Causes

  • You are still signed in through emergency access and tried to recover the account of a person who lost their authenticators.
  • You tried to recover your own account, or another break-glass identity, from the emergency session.

Response Example

{
  "type": "https://docs.ankatech.co/errors/break-glass-session-cannot-recover-identity",
  "title": "Break-Glass Session Cannot Recover Identity",
  "status": 403,
  "detail": "A break-glass session cannot recover an identity. Sign in normally to perform the recovery. Nothing was changed.",
  "instance": "/api/v3/admin/platform/identity-recoveries",
  "timestamp": 1760951700,
  "extensions": {
    "requestId": "4e2a9c71-0b3d-4f58-a6e1-9d7c2b5f8e30"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Sign out of the break-glass session.
  2. Sign in normally as a platform administrator who holds the permission to recover identities.
  3. Perform the recovery from that normal session. When no platform administrator can sign in at all, the operator of the deployment recovers platform access from the environment host instead.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.