Skip to content

Custody Stage Not Verified

URI: https://docs.ankatech.co/errors/custody-stage-not-verified
HTTP Status: 409 Conflict

When you see this

A verify step unwrapped the copies staged for a key custody window under the destination key-encryption key, and at least one did not unwrap. At the reopen, the same answer means the destination refused the round trip on the tenant's live keys. A destination that is unavailable or throttled is not this problem: it answers its own retryable 503, nothing is learned about the copies, and the step is asked again.

This problem is answered by the key service to the platform's own administration service while it drives a key custody move, one bounded re-wrap step per call. It is never answered to a browser, an SDK or an API client, so its instance names an internal call and is not reproduced here. An operator sees its effect on the move instead: the move's state on the tenant's key custody read, and the audit trail of the move.

Response Example

{
  "type": "https://docs.ankatech.co/errors/custody-stage-not-verified",
  "title": "Custody Stage Not Verified",
  "status": 409,
  "detail": "A staged copy did not unwrap under the destination key-encryption key.",
  "correlationId": "6a0c2f9e-3d71-4b58-8e24-c1f5a7d9b036",
  "timestamp": 1793696400
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail is fixed: it names no tenant, key, key-encryption key or count.

How to Resolve

  1. Before the swap, the window aborts and the tenant reopens on its unchanged source.
  2. At the reopen, the engine rolls the swap back, restores the previous wrapped keys and the source backend, and reopens the tenant on the source.
  3. Check the destination backend (its connection test, its credential, the key's state at the provider) before scheduling the move again.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.