Skip to content

Deployment Backend Custody Unavailable

URI: https://docs.ankatech.co/errors/deployment-backend-custody-unavailable
HTTP Status: 503 Service Unavailable

When you see this

The platform itself could not complete the operation on the deployment key-protection backend. Nothing about your backend was measured, so the body carries no verdict and no reason — the fault is on this side, not in your cloud account. The response includes a Retry-After header. Nothing was changed, and no credential is stored unsealed as a fallback.

Common Causes

  • The platform's own per-tenant secret custody root is not provisioned, so a credential cannot be sealed at all.
  • The wrap leg of the credential proof could not be built: the credential in effect could not be unsealed, decoded, or used to construct a client. The candidate was never examined, so it is not blamed.

Response Example

{
  "type": "https://docs.ankatech.co/errors/deployment-backend-custody-unavailable",
  "title": "Deployment Backend Custody Unavailable",
  "status": 503,
  "detail": "The platform could not complete the operation on the deployment key-protection backend. Nothing was changed; retry once the platform's own secret custody is available.",
  "instance": "/api/v3/admin/platform/setup/backend/credential",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "4d81f26b-0c39-47ae-9f52-3a7be1c04d88"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Do not change anything in your cloud account — this refusal names nothing you could fix there.
  2. Confirm the platform's own key-protection state with GET /api/v3/admin/platform/setup/status, and complete first-run provisioning if the environment is not yet bound.
  3. Retry the request after the interval in the Retry-After header. Nothing was persisted, so the retry is safe.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.