Skip to content

Deployment Backend Changed During The Write

URI: https://docs.ankatech.co/errors/deployment-backend-changed-during-write
HTTP Status: 409 Conflict

When you see this

A write of the deployment key-protection credential (PATCH /api/v3/admin/platform/setup/backend/credential) — a new credential, or the restore of the retained previous one — proved the candidate credential against the backend, and then found that what it had proved against no longer stands: the backend configuration, the credential in effect or the declaration changed while the proof ran.

The proof is a remote round trip and runs outside any database lock, and the envelopes are wrapped by the custody root before the lock is taken. Putting the credential into effect is a separate step: under the deployment_info lock it only compares what the proof was made against and stores, in one transaction. That step refuses when the state the proof was made against has moved, because promoting the candidate would put into effect a credential proved against something else.

What this refusal leaves behind. Nothing: the credential in effect is unchanged, the candidate was not put into effect and its envelope was deleted. This is a 409 because the request conflicts with a change in the deployment's state during the request (RFC 9110 §15.5.10).

Common Causes

  • Another administrator reconfigured, re-declared or withdrew the backend, or replaced the credential, while the candidate credential was being proved.
  • Two credential replacements were submitted close together, and the other one was put into effect first.

Response Example

{
  "type": "https://docs.ankatech.co/errors/deployment-backend-changed-during-write",
  "title": "Deployment Backend Changed During The Write",
  "status": 409,
  "detail": "The deployment key-protection configuration, its credential or its declaration changed while this credential was being proved, so it was not put into effect: the credential in effect is unchanged. Read the configuration again and retry.",
  "instance": "/api/v3/admin/platform/setup/backend/credential",
  "timestamp": 1787494020,
  "extensions": {
    "requestId": "91c4e7a2-3b58-4d06-8f1e-c2a9d5b7e043"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail is a fixed sentence. It names no coordinate and no credential.

How to Resolve

  1. Read the configuration again (GET /api/v3/admin/platform/setup/backend/configuration) and confirm the backend it names is the one you are supplying a credential for.
  2. Submit the credential write again — the new credential, or the restore.

A credential write attempted while an activation is in flight is refused earlier and differently, with Key-Protection Backend Activation In Progress.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.