Skip to content

Custody Source KEK Required

URI: https://docs.ankatech.co/errors/custody-source-kek-required
HTTP Status: 422 Unprocessable Content

When you see this

A swap found a key whose current wrapping key-encryption key is not recorded — a key written before the platform recorded it — and the request named no source key-encryption key to record as that key's previous one. Nothing was swapped.

This problem is answered by the key service to the platform's own administration service while it drives a key custody move, one bounded re-wrap step per call. It is never answered to a browser, an SDK or an API client, so its instance names an internal call and is not reproduced here. An operator sees its effect on the move instead: the move's state on the tenant's key custody read, and the audit trail of the move.

Response Example

{
  "type": "https://docs.ankatech.co/errors/custody-source-kek-required",
  "title": "Custody Source KEK Required",
  "status": 422,
  "detail": "A key's current key-encryption key is not recorded and the request names no source one.",
  "correlationId": "6a0c2f9e-3d71-4b58-8e24-c1f5a7d9b036",
  "timestamp": 1793696400
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail is fixed: it names no tenant, key, key-encryption key or count.

How to Resolve

  1. The window aborts before its swap and the tenant reopens on its unchanged source.
  2. Schedule the move again; the move names its source key-encryption key when it starts.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.