Skip to content

Crypto Playground Delegation Refused

URI: https://docs.ankatech.co/errors/crypto-playground-delegation-refused
HTTP Status: 403 Forbidden

When you see this

The Cryptographic Playground asked the Auth API for a token to run the operation as its Actor, and the Auth API refused to delegate the run, so nothing ran. For every run, the Admin API asks the Auth API, service to service, for a short-lived token for that Actor under the administrator's delegation; the Auth API checks the administrator's own session and role before it issues one. extensions.failureSource is DELEGATION and extensions.executionStatus is NOT_EXECUTED: the cryptographic service was never called. extensions.runtimeCorrelationId names the execution, as the operator's audit record and the token request carry it.

Returned by POST /api/v3/admin/tenants/{tenantId}/crypto-playground/execute (executeCryptoPlaygroundOperation). The operator's audit record was written before the request for the token. The Admin API never retries the request.

The body never says which check refused: the Auth API answers every refusal with the same sentence, and records the cause in its own audit record (auth.token.delegation.failure), which the deployment's audit trail shows. Only that refusal is this problem; any other refusal by the Auth API, such as of the Admin API's own service credential, is Crypto Playground Delegation Unavailable.

Common Causes

  • The administrator's session ended or was revoked after the page was loaded.
  • The administrator's role does not hold the Cryptographic Playground's execute permission in this tenant.
  • The session is a platform super administrator's support session on a private cloud or on-premises deployment, and its own sign-in has ended or its platform membership changed after it was opened. On a deployment ANKATech operates, a support session is refused before any token is requested, with Operation Not Available While Impersonating.

Response Example

{
  "type": "https://docs.ankatech.co/errors/crypto-playground-delegation-refused",
  "title": "Crypto Playground Delegation Refused",
  "status": 403,
  "detail": "The authentication service refused to issue a token to run this operation as the Actor under your delegation, so the operation was not executed. Your session or role cannot delegate this run.",
  "instance": "/api/v3/admin/tenants/8d2f1c4e-3b7a-4e91-a6d5-0c9f2e8b7a14/crypto-playground/execute",
  "extensions": {
    "failureSource": "DELEGATION",
    "executionStatus": "NOT_EXECUTED",
    "runtimeCorrelationId": "6f2c1e9a-3d47-4b58-9a10-5e7c2b8d4f36",
    "requestId": "7c9e6679-7425-40de-944b-e07fc1f90ae7"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Sign in again and run the operation once more: a session that ended cannot delegate until it is replaced.
  2. If it is still refused, the operation is not one your role may run in this tenant: a tenant administrator or key manager of the tenant runs it.
  3. Running it again unchanged does not help: a refusal is a statement about the session, not a transient failure. Compare Crypto Playground Delegation Unavailable, which is.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.