Skip to content

Custody Roll Back Unavailable

URI: https://docs.ankatech.co/errors/custody-rollback-unavailable
HTTP Status: 409 Conflict

When you see this

A roll back named a key-encryption key the tenant can no longer return to. Nothing was written.

When a key custody move completes, the key-encryption key the tenant left is retired and retained for 30 days. During that time a roll back moves the tenant's keys back to it, through the same engine and the same window as any other move. After that the key stays retired, and a roll back to it is refused.

Common Causes

  • The retention period of the key-encryption key has passed.
  • The key-encryption key was retired by a re-key after a suspected compromise: such a key is never returned to and is not retained for a roll back.
  • The retainedKekId does not name one of this tenant's retained key-encryption keys.

Response Example

{
  "type": "https://docs.ankatech.co/errors/custody-rollback-unavailable",
  "title": "Custody Roll Back Unavailable",
  "status": 409,
  "detail": "The key-encryption key a roll back would return to is no longer retained. Nothing was written.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/rollback",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the tenant's key custody: retainedKeks lists every key-encryption key a roll back can still return to, with its retainUntil.
  2. If the key you need is not listed, move the tenant forward instead: start a new custody move to the backend you want the tenant on.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.