Skip to content

Custody Operation Not On This Plane

URI: https://docs.ankatech.co/errors/custody-move-not-on-this-plane
HTTP Status: 403 Forbidden

When you see this

A key custody operation was asked of a plane that does not perform it for this tenant on this deployment. Nothing was written. The caller holds the scope; the refusal is about who decides this kind of move, not about the caller's permissions.

Who moves a tenant's keys depends on the deployment type:

Deployment Platform plane (/api/v3/admin/platform/tenants/{tenantId}/key-custody) Tenant plane (/api/v3/admin/tenants/{tenantId}/key-custody)
SaaS Schedules the moves an Edition change records between the ANKATech-managed tiers; rotates and re-keys managed key-encryption keys; rolls a tenant back between managed tiers Chooses the destination after an upgrade to ENTERPRISE, accepts the move of a downgrade off its own key management service, changes, schedules, cancels or aborts moves of its own key management service, and rolls back onto or off it: back to an own key it left, or from its own key back to the ENTERPRISE tier it left
Private cloud, on-premise Moves a tenant between the deployment backend and its own key management service, and back; rotates and re-keys; rolls back The same moves, only when the HSM / Cloud KMS integration family is delegated to the tenant

Common Causes

  • On SaaS, a platform administrator asked a key custody operation that moves a tenant to, between or off its own key management service. That is the tenant administrator's decision alone (the BYOK declaration endpoints of the platform plane answer 403 deployment-not-supported on SaaS for the same reason).
  • On SaaS, a platform administrator asked for a roll back of a tenant that is on its own key management service, or back to one of its own keys. A roll back onto or off a tenant's own key management service is the tenant administrator's: the platform never takes a tenant off its own key management service.
  • On SaaS, a tenant administrator tried to start a move between managed tiers, or a roll back between managed tiers. Those follow from the tenant's Edition, which the platform administrator changes.

Response Example

{
  "type": "https://docs.ankatech.co/errors/custody-move-not-on-this-plane",
  "title": "Custody Operation Not On This Plane",
  "status": 403,
  "detail": "This key custody operation is not performed from this plane for this tenant on this deployment. Nothing was written.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/moves",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Do not audit the caller's roles: the scope is present.
  2. Send the request on the plane the table above names for this deployment type, or ask the person who owns that decision (the tenant administrator for a tenant's own key management service on SaaS; the platform administrator for an Edition change).
  3. On a customer-operated deployment, a tenant administrator who needs to move its own custody asks the platform operator to delegate the HSM / Cloud KMS integration family to the tenant; without the delegation the tenant plane answers integration-delegation-required.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.