Skip to content

Compliance Remediation Conflict Unacknowledged

URI: https://docs.ankatech.co/errors/compliance-remediation-conflict-unacknowledged
HTTP Status: 409 Conflict

When you see this

A tenant confirmed a step of a compliance remediation action (POST /api/v3/admin/tenants/{tenantId}/compliance-remediation/{packId}/actions/{actionKey}/executions), and the targets it chose would make an item of another licensed pack newly fail, while the request's acknowledgedConflicts does not list that conflict. The Admin API re-evaluates every licensed pack with each chosen target substituted, and once with all of them substituted together; every item that would newly fail is a conflict {packId, itemKey, statement, kids}. The response lists the unacknowledged conflicts. Nothing was executed, no execution was recorded and no audit row was written.

The platform never chooses between packs: each one is an obligation of the customer's.

See Compliance Remediation Plans — conflicts between packs.

Common Causes

  • The request was built without reading the preview's conflicts.
  • A conflict that appears only when several targets are applied together was not acknowledged.
  • A pack was licensed after the preview, so a new conflict exists.

Response Example

{
  "type": "https://docs.ankatech.co/errors/compliance-remediation-conflict-unacknowledged",
  "title": "Remediation Conflict Unacknowledged",
  "status": 409,
  "detail": "The chosen targets newly fail items of a licensed compliance pack that the request did not acknowledge; acknowledge each listed conflict to proceed.",
  "instance": "/api/v3/admin/tenants/6f1b2c4e-8a3d-4f7e-9c21-5b0d7e9a1f34/compliance-remediation/NSA_CNSA_2_0/actions/CNSA.ADMIT.GENERAL/executions",
  "extensions": {
    "requestId": "9a4c2e71-0b3d-4f58-8e6a-1c7d5b2f0e93",
    "conflicts": [
      {
        "packId": "BSI_TR_02102_1",
        "itemKey": "BSI.HYBRID.KEM",
        "statement": "Post-quantum key establishment is used in a hybrid with a classical scheme.",
        "kids": ["vault-kem-hybrid"]
      }
    ]
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The unacknowledged conflicts are listed under extensions.conflicts; in the example, moving vault-kem-hybrid to ML-KEM-1024 under NSA_CNSA_2_0 newly fails BSI.HYBRID.KEM of BSI_TR_02102_1.

How to Resolve

  1. Read each listed conflict and decide whether your organisation accepts it.
  2. To proceed, add each conflict to acknowledgedConflicts and confirm again with a new Idempotency-Key; in the console, tick each conflict's checkbox.
  3. To avoid it, preview again and choose another target from the candidate set.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.