Skip to content

Composite Wire Shape Mismatch

URI: https://docs.ankatech.co/errors/composite-wire-shape-mismatch
HTTP Status: 422 Unprocessable Entity

When you see this

The cryptographic message you supplied does not match the wire shape the operation expects — for example the number or ordering of component values does not align with the composite key definition, or a detached JWS sent to a streaming signature route is not the RFC 7797 detached form. The detached-form check applies to SIMPLE and COMPOSITE keys alike.

Common Causes

  • Submitting a composite ciphertext or signature whose component layout differs from the key's definition.
  • Mixing component values from different composite keys.
  • A serialization that does not preserve the expected composite structure.
  • On POST /api/v3/crypto/stream/verify and POST /api/v3/crypto/stream/resign, a detached JWS whose protected header does not set b64 to the JSON boolean false and list it in crit (RFC 7797 sections 3 and 6), or whose body is not one flattened signature (a signatures array, a member the flattened serialization does not define, or no or an empty signature), or a Compact token that carries a payload. It is refused before any key is resolved.

Response Example

{
  "type": "https://docs.ankatech.co/errors/composite-wire-shape-mismatch",
  "title": "Composite Wire Shape Mismatch",
  "status": 422,
  "detail": "The composite message wire shape does not match the expected structure for this key.",
  "instance": "/api/v3/crypto/decrypt",
  "correlationId": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Confirm the composite message was produced with the same composite key definition you are using to process it.
  2. Do not reorder, drop, or substitute component values within a composite message.
  3. Regenerate the composite message with a compliant serialization and re-submit.
  4. For a streaming verify or re-sign, send the detached JWS the streaming sign route produced, unchanged: b64:false listed in crit, one flattened signature.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.