Skip to content

Compliance Evidence Too Large

URI: https://docs.ankatech.co/errors/compliance-evidence-too-large
HTTP Status: 422 Unprocessable Entity

When you see this

A tenant requested the compliance evidence package or the signed compliance evidence of one pack, and the CycloneDX document the platform produced for it exceeds the bound of 16 MiB. The Admin API answers it on GET /api/v3/admin/tenants/{tenantId}/compliance-evidence/{packId}/package and GET /api/v3/admin/tenants/{tenantId}/compliance-evidence/{packId}, before any report is rendered and before anything is signed. No report was rendered, no document was signed or served, and no audit row was written.

The document lists one CycloneDX component per live key of the tenant, so its size grows with the number of live keys and with the length of their identifiers. A key costs about 0.7 KiB at a typical identifier length and up to about 1.6 KiB with a long identifier named by many items, so the bound admits at least about 10,000 live keys. See Compliance Evidence.

Common Causes

  • The tenant holds more live keys (ACTIVE, EXPIRED or SUSPENDED) than one document can describe within the bound.
  • Many keys carry long identifiers and are named by many items of the pack.

Response Example

{
  "type": "https://docs.ankatech.co/errors/compliance-evidence-too-large",
  "title": "Compliance evidence too large",
  "status": 422,
  "detail": "The compliance evidence document for this pack exceeds the size bound, so it was not signed.",
  "instance": "/api/v3/admin/tenants/6f1b2c4e-8a3d-4f7e-9c21-5b0d7e9a1f34/compliance-evidence/NIST_PQC_TRANSITION",
  "extensions": {
    "requestId": "7c2e9a41-3b6d-4f08-a5c1-9d0e2b7f4a63"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Retrying does not help: the same live keys produce the same size.
  2. Reduce the number of live keys: a revoked key is never listed, so revoking keys that no longer protect anything removes them from the document.
  3. The evaluation itself stays readable with GET /api/v3/admin/tenants/{tenantId}/compliance-evaluations/{packId}, which has no such bound.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.