Deployment License Expired

URI: https://docs.ankatech.co/errors/deployment-license-expired
HTTP Status: 402 Payment Required

When you see this

The deployment you are calling no longer holds a valid license, and the operation you requested creates new protection or new key material. The deployment has entered cryptographic read-only mode: it still serves the data it already protected, and it refuses to protect anything new.

This is a deployment-wide condition, not a property of your tenant, your client or your token. Every caller of that deployment sees the same refusal on the same operations.

What still works, and what does not

Read-only mode is defined by the operation, not by the caller.

Still served on an expired deployment

• decrypt, verify, decrypt-verify — and their streaming forms
• key metadata reads, key listings, the supported-algorithm catalogue
• the rotation-admissibility preview
• key revoke — see the note below
• analyze-pkcs7 and its streaming form
• interoperability verify
• monitoring and limits reads

Refused with this problem

• encrypt, sign, sign-encrypt, reencrypt, resign — and their streaming forms
• interoperability encrypt
• key generation, key rotation, key import, keystore import and keystore analyze
• convert-pkcs7-to-jose and its streaming form

You never lose access to data the platform already protected for you. The refusal applies only to producing something new.

Common Causes

• The deployment's license term ended and its grace window has also passed.
• The deployment's evaluation period ended and no signed license was imported before it did.
• A renewal was issued but is not yet in effect — a license takes effect on its own start date, so a replacement imported early does not shorten the gap left by a license that has already lapsed.

None of these are caused by anything you sent. The request itself was well formed.

Response Example

{
  "type": "https://docs.ankatech.co/errors/deployment-license-expired",
  "title": "Deployment License Expired",
  "status": 402,
  "detail": "The deployment license has expired. Contact your platform administrator to renew it.",
  "instance": "/api/v3/crypto/encrypt",
  "timestamp": 1791676805
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

There is nothing to change in your request, and retrying will not clear it. The remedy belongs to whoever operates the deployment.

1. Contact your platform administrator and report that the deployment license has expired. Give them the instance path and the X-Correlation-Id response header value.
2. Continue reading in the meantime. Decrypt, verify and metadata reads keep working, so an application that only needs access to existing data is unaffected.
3. Retry the refused operation after the administrator confirms the renewal is in effect. A replica picks the new state up on its own within a few minutes of the import; no client change and no reconnection is required.

If you operate this deployment yourself, renewal is an administrator task performed against the License Server, not a client-side change.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.