Skip to content

Credential Rotation Not Applicable

URI: https://docs.ankatech.co/errors/credential-rotation-not-applicable
HTTP Status: 422 Unprocessable Entity

When you see this

You asked to rotate or restore the backend credential of an ANKA-managed key-protection tier whose authentication material is not under console custody. The request is well formed and the tier exists — the operation simply does not apply to this tier's backend. The gate runs before anything is sealed and before the cross-credential round trip, so nothing was verified against the backend and nothing was written.

Common Causes

  • The tier's backend class takes no console-managed credential at all; its authentication material is provisioned out of band.
  • The tier's credential has never been placed under console custody, so there is nothing to rotate or restore.

Response Example

{
  "type": "https://docs.ankatech.co/errors/credential-rotation-not-applicable",
  "title": "Credential Rotation Not Applicable",
  "status": 422,
  "detail": "This tier's backend does not take a console-managed credential. Its authentication material is provisioned out of band and can only be re-asserted through the documented restore procedure.",
  "instance": "/api/v3/admin/platform/key-backend/tiers/ENTERPRISE/credential",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Confirm which tier you targeted: the body is identical for every tier and names no backend family, so the tier in the request path is what identifies the case.
  2. Re-assert this tier's authentication material through the documented out-of-band restore procedure for its backend, not through the console credential endpoint.
  3. The tier's credential currently in effect is unchanged, so no rollback is needed.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.