Credential Endpoint Changed

URI: https://docs.ankatech.co/errors/credential-endpoint-changed
HTTP Status: 409 Conflict

When you see this

You wrote a credential, through its own credential-only operation or through an identity provider edit that writes a new secret without submitting trustAnchors (for every provider kind), and the endpoint that credential is presented to is no longer the one you read. Between your read and your write, the endpoint moved: the settings that name it were changed or reset, or the provider's relay was reconfigured. A sealed credential is only ever stored for the endpoint it was meant for, so the write is refused and nothing is sealed. The credential in effect, if there was one, is left as it was.

Every read of such a destination answers an opaque endpointFingerprint of the endpoint it is bound to at that moment. The credential-only write sends that value back, and it is compared with the endpoint bound when the write commits. extensions.field names the request member that carries it.

Operation	Endpoint the fingerprint covers	Where to read `endpointFingerprint`
`PATCH /api/v3/admin/platform/key-backend/tiers/{tier}/credential` (ANKA-managed tier credential)	the tier's AWS KMS endpoint override and region, and its Azure Key Vault URL	each tier of `GET /api/v3/admin/platform/key-backend/tiers`
`PUT .../notification/providers/{id}/credential` on the platform, platform-on-behalf and tenant planes (notification provider credential)	the account or relay the credential is issued for: an SMTP relay's host, port, transport security and internal-host posture; a Microsoft Graph `azureTenantId` and `clientId`; a Twilio `accountSid`; a Gmail `serviceAccountClientEmail`	the provider's read; absent on SendGrid and webhook providers
`PUT /api/v3/admin/platform/settings/tsa_client_credential` (deployment time-stamping credential)	`TSA_ENDPOINT_URL`	`GET /api/v3/admin/platform/settings/tsa_client_credential`
`PATCH /api/v3/admin/platform/setup/backend/credential` (deployment key-protection credential: establish, rotate or restore)	the declared endpoint and key id	`GET /api/v3/admin/platform/setup/backend/configuration`
`PUT /api/v3/admin/platform/idp/{id}` that writes a new secret and omits `trustAnchors` (identity provider secret)	the issuer, LDAP URL, metadata URL, Graph base URI, allowed endpoint hosts and the pinned trust anchors	the provider's read

The fingerprint is a digest of the endpoint that the platform only compares for equality. It is not an access control, so do not rely on it to hide the endpoint. Send back the value you read, and never compute it yourself.

A write that sends no fingerprint is refused with Precondition Required (428) instead. SendGrid and webhook providers name no account or endpoint in their configuration, so their credential write does not read the member.

Common Causes

Another administrator moved the destination's endpoint while you were entering the credential.
A script read the destination once, and after that the endpoint was reconfigured before the script sent the credential.
An edit form kept a fingerprint from an earlier page load.

Response Example

{
  "type": "https://docs.ankatech.co/errors/credential-endpoint-changed",
  "title": "Credential Endpoint Changed",
  "status": 409,
  "detail": "The endpoint of this destination changed after it was read; the credential was not stored. Read the destination again and supply the credential for the endpoint it shows.",
  "instance": "/api/v3/admin/platform/key-backend/tiers/PROFESSIONAL/credential",
  "timestamp": 1790000000,
  "extensions": {
    "field": "endpointFingerprint",
    "requestId": "4c1e8a2f-6b3d-4f70-9a15-2d8e7c0b5f13"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

Read the destination again and check the endpoint it now names.
If that is the endpoint you mean, obtain the credential it expects and repeat the write with the endpointFingerprint you just read.
If it is not the endpoint you mean, correct the endpoint first. Then read again and write the credential.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.