Skip to content

Conferring Authority Required

URI: https://docs.ankatech.co/errors/conferring-authority-required
HTTP Status: 403 Forbidden

When you see this

The operation would give a Cryptographic Actor at least one operation scope it does not already hold, and you do not hold admin.tenant.actor.roles.assign. A Capability Grant confers standing authority on its actor — the scopes the grant derives become part of every token the actor mints — so creating one that adds a scope requires the same authority as assigning that scope to the actor directly. Nothing was written.

Two writes raise it:

  • activateExchange — activating a Cryptographic Exchange creates its grant;
  • createCapabilityGrant — a standalone grant.

It is raised only when the grant would add something. A grant whose scopes the actor already holds needs no conferring authority, and the refusal is evaluated last — after every refusal that holds for any caller (the Exchange's state, the key, the actor's status) — because it is the only one that depends on who is calling.

This is not Forbidden. You hold the scope the operation itself requires; what you lack is the authority to confer. The requiredScope extension member names the scope that would admit the request.

The response deliberately does not say which scopes would be added, nor how many. Naming them would tell a caller who cannot read the actor's roles what the actor already holds. previewExchangeActivation and previewCapabilityGrant report this refusal inside their 200 response, on the same terms.

Common Causes

  • An Exchange or grant administrator who holds admin.tenant.exchange.activate or admin.tenant.capability-grant.create but not admin.tenant.actor.roles.assign.
  • A custom role composed for grant management without the roles-assign scope.

Response Example

{
  "type": "https://docs.ankatech.co/errors/conferring-authority-required",
  "title": "Conferring Authority Required",
  "status": 403,
  "detail": "This operation would confer at least one new operation scope on the actor, which requires admin.tenant.actor.roles.assign.",
  "instance": "/api/v3/admin/exchanges/7d2f4a10-9c31-4b8e-a5d6-2f11c0b47e93/activate",
  "timestamp": 1730000000,
  "extensions": {
    "requiredScope": "admin.tenant.actor.roles.assign",
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Ask a tenant administrator who holds admin.tenant.actor.roles.assign to perform the activation or create the grant.
  2. Or have that scope added to your role, if your organisation's separation of duties allows it.
  3. Use the preview first to confirm whether a given capability would add a scope at all.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.