Credential Required for Endpoint Change

URI: https://docs.ankatech.co/errors/credential-required-for-endpoint-change
HTTP Status: 400 Bad Request

When you see this

An update changes the endpoint of an integration destination that holds a sealed credential, and the request supplies no credential for the new endpoint. A sealed credential was issued for the endpoint it was sealed beside, and the platform never presents it to another one. It never discards it silently either, so the update is refused and nothing is written: the destination, its endpoint and its sealed credential are exactly as they were.

The endpoint is compared whole — scheme, host, port and path — so a change of the path or the port alone is an endpoint change. A change of the sink type or the vendor, which decides how the endpoint is reached, counts as one too. An absent credential, a blank one and the masked read value (•••••• or ********) all count as absent.

extensions.field names the request member that carries the credential.

Operation	Endpoint members compared	`extensions.field`
`replaceObservabilityBackend`, `replacePlatformObservabilityBackend` (tenant observability destination)	`endpoint`, `vendor`	`apiKey`
`replacePlatformBackend` (platform observability backend)	`endpoint`, `vendor`	`apiKey`
`replacePlatformDestination`, `replaceDestination` (event-forwarding destination)	`sinkType`; Splunk HEC and Webhook `endpoint`; Sentinel `endpoint`, `tokenEndpoint` and `tenantId`; Syslog `host` and `port`, for a destination holding a client certificate's key; the pinned `trustAnchorsPem`, compared as a set of certificate fingerprints, so adding, removing or replacing an anchor is a change and reordering is not	`secret`
`replacePlatformTimestampingOverride` (per-tenant time-stamping connection)	`tsaEndpointUrl`	`tsaClientCredential`
The platform alert destination replace (`PUT /api/v3/admin/platform/alerts/destinations/{destinationId}`)	`config.url`	`config.signingSecret`

A destination that holds no sealed credential moves freely: there is nothing to reuse. An update that keeps the endpoint keeps the sealed credential without supplying it.

Integrations whose credential is written on its own route (a notification provider credential, the deployment time-stamping credential, the ANKA-managed tier credentials, the deployment key-protection credential and an identity provider's secret) never answer this error: a move of their endpoint destroys the sealed credential instead, records it in a signed audit row, and the destination reads as having no credential until the credential is written again. The credential-only write of the tier credential, a notification provider credential, the deployment time-stamping credential and the deployment key-protection credential, and an identity provider edit that writes a secret while keeping the pinned trust anchors, carry the endpointFingerprint its read answered, so a credential is never sealed for an endpoint that moved after that read (Credential Endpoint Changed).

Common Causes

An edit form round-tripped the masked credential while the operator changed the URL.
A client moved a destination to a new collector, vault or authority and did not send the credential the new one expects.
An event-forwarding destination was switched to another sink type that takes a credential.

Response Example

{
  "type": "https://docs.ankatech.co/errors/credential-required-for-endpoint-change",
  "title": "Credential Required for Endpoint Change",
  "status": 400,
  "detail": "The endpoint of this destination changed and a credential is sealed for the previous endpoint; a sealed credential is never reused for a new endpoint. Repeat the request with the credential for the new endpoint.",
  "instance": "/api/v3/admin/platform/event-forwarding/destinations/0b6f3e2a-71c4-4d98-b5a0-8e1f2c3d4a57",
  "timestamp": 1790000000,
  "extensions": {
    "field": "secret",
    "requestId": "9a4d2c7e-1f83-4b56-8e0a-3c7b5d1f9e24"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

Obtain the credential the new endpoint expects (a new HEC token, API key, client secret or signing secret).
Repeat the same request with that credential in the member extensions.field names.
To move a per-tenant time-stamping connection to an authority that takes no credential, revert the override first (deletePlatformTimestampingOverride), which destroys the sealed credential, and write the new connection without one.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.