Deployment Not Supported

URI: https://docs.ankatech.co/errors/deployment-not-supported
HTTP Status: 403 Forbidden

When you see this

The surface you called does not exist on this deployment model. This is a policy gate keyed on the deployment type — a platform-global fact — not on your role or anything in the request body. One surface also keys it on your tenant: a platform-plane account recovery refuses a caller outside the platform plane with this same type (see the third cause below). It carries its own type rather than the generic forbidden precisely so an operator does not go and audit an RBAC assignment that is correct.

Common Causes

• A SaaS-only per-tenant surface called on a customer-operated deployment. Per-tenant observability export, per-tenant Edition assignment and managed key-protection tier configuration exist only where there are many tenants; on a private-cloud or on-premise deployment the whole stack belongs to one customer and the per-tenant plane is inert.
• A deployment-wide surface called on a SaaS deployment. The deployment-wide verified email-domain set and the deployment-wide trusted-issuer registry are offered only where the operator also owns the workloads and identities involved; on SaaS each tenant declares its own.
• A platform-plane account recovery the deployment does not admit. Force password reset and platform-plane activation-token regeneration return a credential for the addressed account, so an account of a customer tenant is recoverable only on PRIVATE_CLOUD / ON_PREMISE; on SAAS / DEDICATED_SAAS the platform operator is not the customer. This refusal also answers a caller that is not on the platform plane, with the same detail, so the body reveals neither the deployment model nor the caller's plane. Rules: Who may recover an account from the platform plane^*.

Response Example

{
  "type": "https://docs.ankatech.co/errors/deployment-not-supported",
  "title": "Deployment Not Supported",
  "status": 403,
  "detail": "Per-tenant observability export is available only on a SaaS deployment.",
  "instance": "/api/v3/admin/platform/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/observability/entitlement",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

1. Read the detail: each refusing surface supplies its own fixed sentence naming the surface and the deployment class it belongs to.
2. Do not change the caller's scopes or roles — this refusal is independent of them and a role change will not lift it.
3. Use the plane that this deployment does offer. Where a deployment-wide declaration is refused, declare it on the tenant that needs it; where a per-tenant surface is refused, the environment-wide configuration already governs every tenant.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.