Skip to content

Compliance Remediation Basis Changed

URI: https://docs.ankatech.co/errors/compliance-remediation-basis-changed
HTTP Status: 409 Conflict

When you see this

A tenant confirmed a step of a compliance remediation action (POST /api/v3/admin/tenants/{tenantId}/compliance-remediation/{packId}/actions/{actionKey}/executions), and the basis the request carries is not the one the Admin API recomputes over the current state. The basis is the SHA-256 the preview returned over the reference day, the pack version, the action key, the step, and the kid, material version, algorithm and expiry of every key of the action, whichever page the preview listed. Something it covers changed after the preview, so what the person confirmed is no longer what would run. Nothing was executed, no execution was recorded and no audit row was written.

See Compliance Remediation Plans — preview and confirmation.

Common Causes

  • Another session rotated, patched or revoked one of the listed keys after the preview.
  • The reference day changed (the preview was taken before midnight UTC and confirmed after it), or the pack moved to a new version. A proposed expiry is anchored to 00:00 UTC of the reference day, so a preview from another day is answered here, before its expiresAt values are compared, never with a 400.
  • A previous run of the same action, under another Idempotency-Key, already changed the keys. A retry of that run with its own Idempotency-Key is answered from the stored execution instead.

Response Example

{
  "type": "https://docs.ankatech.co/errors/compliance-remediation-basis-changed",
  "title": "Remediation Basis Changed",
  "status": 409,
  "detail": "The keys or the pack changed since the preview; preview the step again and confirm the new preview.",
  "instance": "/api/v3/admin/tenants/6f1b2c4e-8a3d-4f7e-9c21-5b0d7e9a1f34/compliance-remediation/NSA_CNSA_2_0/actions/CNSA.ADMIT.GENERAL/executions",
  "extensions": {
    "requestId": "3d8f1a62-5c4b-4e07-9a2d-7b1e6c0f9a45"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Preview the step again (GET …/actions/{actionKey}/preview?step=) and review the keys and targets it now lists.
  2. Confirm with the new basis and a new Idempotency-Key.
  3. A key that another session already fixed no longer appears, or is reported as already done.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.