Skip to content

Cross-Kid Arity Violation

URI: https://docs.ankatech.co/errors/cross-kid-arity-violation
HTTP Status: 422 Unprocessable Entity

When you see this

The internal crypto use case you submitted does not name the right number of keys for the operations it declares. REENCRYPT and RESIGN bind a source and a target and therefore require targetKeyKid; every other operation set forbids one. The rule fixes the arity of the capability grant the request would emit, so it is enforced before anything is provisioned.

Common Causes

  • REENCRYPT or RESIGN was declared and targetKeyKid was omitted or left blank.
  • targetKeyKid was supplied on a request whose operations are none of the cross-kid ones, where the grant would never reference it.
  • A cross-kid operation was removed from operations while the target key reference was left in the body.

Response Example

{
  "type": "https://docs.ankatech.co/errors/cross-kid-arity-violation",
  "title": "Cross-Kid Arity Violation",
  "status": 422,
  "detail": "Cross-kid operations (REENCRYPT, RESIGN) require targetKeyKid naming the destination key.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/internal-crypto-use-cases",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the detail: it says which of the two arms fired — a missing target, or a target that no declared operation uses.
  2. For REENCRYPT or RESIGN, add targetKeyKid naming the destination key. Naming the same kid as the source is valid and is the in-place migration case.
  3. For any other operation set, remove targetKeyKid, or declare REENCRYPT / RESIGN if a cross-kid use case is what you intended.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.