Skip to content

Compliance Remediation Rotation Admissible

URI: https://docs.ankatech.co/errors/compliance-remediation-rotation-admissible
HTTP Status: 422 Unprocessable Entity

When you see this

A tenant confirmed CREATE_SUCCESSOR_KEY for a compliance remediation action (POST /api/v3/admin/tenants/{tenantId}/compliance-remediation/{packId}/actions/{actionKey}/executions) naming a key that the key service admits rotating under the same Key ID to a target that fixes the item. Rotation (ROTATE_KEY) and a successor key (CREATE_SUCCESSOR_KEY then REVOKE_SUPERSEDED_KEY) are alternative paths, and a successor is the path for a key rotation cannot move, such as a composite key moving to a single algorithm. The detail names the key's position in the request (keys[<index>]). Nothing was reserved or executed, and no audit row was written.

See Compliance Remediation Plans — rotation or a new kid.

Common Causes

  • A client confirmed the successor path for every key of the action without previewing it: the CREATE_SUCCESSOR_KEY preview refuses such a key with the code ROTATION_ADMISSIBLE.
  • A key that could not be rotated when the preview was served can be now, and the same keys were sent again under a new basis.

Response Example

{
  "type": "https://docs.ankatech.co/errors/compliance-remediation-rotation-admissible",
  "title": "Remediation Rotation Admissible",
  "status": 422,
  "detail": "keys[0].kid: the key can be rotated under the same Key ID; rotate it (ROTATE_KEY) instead of creating a successor key.",
  "instance": "/api/v3/admin/tenants/6f1b2c4e-8a3d-4f7e-9c21-5b0d7e9a1f34/compliance-remediation/NSA_CNSA_2_0/actions/CNSA.EXCLUDE.LOWER-LEVELS/executions",
  "extensions": {
    "requestId": "c1e5a9b3-7d24-4f6e-8b0a-2f9d3c6e1a58"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Preview ROTATE_KEY for the action and confirm it for the keys it lists without a refusal.
  2. Preview CREATE_SUCCESSOR_KEY again: confirm it only for the keys it does not refuse.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.