Skip to content

Custody Destination Unsupported

URI: https://docs.ankatech.co/errors/custody-destination-unsupported
HTTP Status: 422 Unprocessable Content

When you see this

A key custody move named a destination the platform cannot move the tenant's keys to, or a key-encryption key rotation or a rotation period was asked of a carrier whose key the platform does not rotate. Nothing was changed.

The platform rotates only the key-encryption keys it holds on a PKCS#11 carrier (the deployment's HSM, or an ANKATech-managed PKCS#11 tier). A managed Cloud KMS tier's key material is rotated by its provider, natively, and a tenant's own key by the tenant in its own key management service; the platform reports how those are rotated and never rotates them.

Common Causes

  • rotatePlatformTenantKek or rekeyPlatformTenantKek on a tenant whose key-encryption key is a managed Cloud KMS key or the tenant's own key.
  • replacePlatformKekRotationPeriod on a carrier that is a Cloud KMS backend.
  • A destination, or a roll back, to a backend this deployment cannot place a key-encryption key of the tenant on — for example a managed tier or a deployment backend whose key-encryption key cannot be provisioned there.
  • A change of the tenant's own key that would run online but that the backend's family cannot carry online.

Response Example

{
  "type": "https://docs.ankatech.co/errors/custody-destination-unsupported",
  "title": "Custody Destination Unsupported",
  "status": 422,
  "detail": "The key custody move names a key-protection backend this platform cannot move a tenant's keys to or rotate on. Nothing was changed.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/kek/rotate",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail names no backend.

How to Resolve

  1. Read the tenant's key custody: kekRotation.rotatedBy says who rotates its key-encryption key (PLATFORM, PROVIDER or CUSTOMER).
  2. For PROVIDER, rotation is the provider's automatic rotation; for CUSTOMER, the tenant rotates its key in its own key management service, or changes its key through a custody move on the tenant plane.
  3. For a destination, choose a backend this deployment offers for the tenant plane.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.