Skip to content

Custody Destination Is The Source

URI: https://docs.ankatech.co/errors/custody-move-destination-is-source
HTTP Status: 409 Conflict

When you see this

A key custody move was started, or its destination chosen, naming the key protection the tenant's keys are already on. There is nothing to move, so no move was recorded and nothing was written.

The destination is compared with the tenant's key protection as it stands when the request arrives:

  • A managed tier: the tenant is assigned that Edition's ANKATech-managed tier already.
  • The deployment backend: the tenant already inherits the deployment's key protection backend.
  • The tenant's own key management service: the tenant is already bound to that same key, on the same service. The key is still proven by its round trip first, so a declaration the service refuses answers that refusal instead; the credential it carried is discarded and never stored.

Another key of the same service, or the same service under another account, region, project, key ring or vault, is a real move and is not refused.

Response Example

{
  "type": "https://docs.ankatech.co/errors/custody-move-destination-is-source",
  "title": "Custody Destination Is The Source",
  "status": 409,
  "detail": "The destination named is the key protection the tenant's keys are already on, so there is nothing to move. Nothing was written.",
  "instance": "/api/v3/admin/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/moves",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail is fixed: it names no backend, key or credential.

How to Resolve

  1. Read the tenant's key custody (GET /api/v3/admin/tenants/{tenantId}/key-custody, or GET /api/v3/admin/platform/tenants/{tenantId}/key-custody on the platform plane): custody and backendType say where the keys are protected now.
  2. If the keys are where they should be, nothing needs to be done.
  3. Otherwise name another destination: another tier, another key of the tenant's own key management service, or, on a customer-operated deployment, a tenant on its own key management service moving back to the deployment backend.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.