Skip to content

Custody Move Awaits Tenant Consent

URI: https://docs.ankatech.co/errors/custody-move-awaits-tenant-consent
HTTP Status: 409 Conflict

When you see this

On a SaaS deployment, a platform administrator tried to schedule a key custody move that moves a tenant off its own key management service because its Edition was lowered. Nothing was changed.

A tenant on its own key management service chose where its keys are protected. When its Edition is lowered, the Edition change is held and the move to the lower Edition's managed tier waits for the tenant administrator, who accepts it by scheduling it. Until then the tenant's effective Edition and its key protection stay as they are. The move reads awaits: TENANT_CONSENT.

Response Example

{
  "type": "https://docs.ankatech.co/errors/custody-move-awaits-tenant-consent",
  "title": "Custody Move Awaits Tenant Consent",
  "status": 409,
  "detail": "The key custody move leaves the tenant's own key management service for a lower Edition and is scheduled by the tenant's administrator, who accepts it. Nothing was changed.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/moves/5e2d4c6b-8a1f-4b3c-9d7e-0f1a2b3c4d5e/schedule",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Tell the tenant administrator that the move is waiting. They schedule it from the tenant's key protection settings in the console or with PUT /api/v3/admin/tenants/{tenantId}/key-custody/moves/{moveId}/schedule; no minimum lead time applies to a move they schedule.
  2. To withdraw the lower Edition instead, assign the Edition in force again: that withdraws the pending move.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.