Deployment Entitlement Unverified

URI: https://docs.ankatech.co/errors/deployment-entitlement-unverified
HTTP Status: 402 Payment Required

When you see this

The deployment you are calling is entitled through its AWS Marketplace subscription, and that entitlement is not verified right now. Until it is, the deployment is in cryptographic read-only mode: it still serves the data it already protected, and it refuses to protect anything new.

This is a deployment-wide condition, not a property of your tenant, your client or your token. Every caller of that deployment sees the same refusal on the same operations.

A deployment entitled through the AWS Marketplace has no licence file. Its entitlement is verified from the instance identity document AWS signs for the instance it runs on, and it is restored as soon as that verification succeeds again. Nothing has to be installed or renewed.

What still works, and what does not

Read-only mode is the same as for an expired deployment licence, and is defined by the operation, not by the caller.

Still served

• decrypt, verify, decrypt-verify, and their streaming forms
• key metadata reads, key listings, the supported-algorithm catalogue
• the rotation-admissibility preview
• key revoke
• analyze-pkcs7 and its streaming form
• interoperability verify
• the licence status, monitoring and health reads

Refused with this problem

• encrypt, sign, sign-encrypt, reencrypt, resign, and their streaming forms
• interoperability encrypt
• key generation, key rotation, key import, keystore import and keystore analyze
• convert-pkcs7-to-jose and its streaming form

The cause member

extensions.cause names one category, and nothing about the instance or its identity document:

The first three are refusals of the evidence and end the entitlement at once. The last two are about obtaining the evidence: while a verification succeeded recently, a failure to obtain it does not refuse anything.

Response Example

{
  "type": "https://docs.ankatech.co/errors/deployment-entitlement-unverified",
  "title": "Deployment Entitlement Unverified",
  "status": 402,
  "detail": "The deployment entitlement is not verified, so the installation is in cryptographic read-only mode. Contact your platform administrator; the cause member names the category.",
  "instance": "/api/v3/crypto/encrypt",
  "correlationId": "4b7e2c19-8d3a-4f61-9a05-1e6c3b8d2f74",
  "timestamp": 1793284805,
  "extensions": { "cause": "imds-unavailable" }
}

Content-Type: application/problem+json: the response follows RFC 9457 Problem Details. The detail is the same for every cause; branch on type, and read extensions.cause to tell an administrator which category applies.

How to Resolve

There is nothing to change in your request, and retrying it immediately will not clear it.

1. Contact your platform administrator and give them the cause, the instance path and the correlationId.
2. Continue reading in the meantime. Decrypt, verify and metadata reads keep working.
3. Retry the refused operation after the administrator confirms the entitlement is verified.

For the platform administrator, by cause:

• imds-unavailable or recovery-window-exceeded: on the instance, the instance metadata service must answer with IMDSv2 required and a hop limit of 1, and the licence evidence timer must be running. Run a verification at once with sudo systemctl start ankasecure-license-evidence@<environmentName>.service; the deployment picks up the result within about a minute.
• product-code-mismatch: run the deployment on an instance launched from the subscribed ANKASecure AWS Marketplace AMI.
• signature-invalid or region-unknown: contact ANKATech support with the correlationId.

The console's License screen shows the same status and cause, and the command to run.

Related

• Deployment License Expired
• License Source Is Not A License File

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.