Skip to content

Deployment Not Supported

URI: https://docs.ankatech.co/errors/deployment-not-supported
HTTP Status: 403 Forbidden

When you see this

The surface you called does not exist on this deployment model. This is a policy gate keyed on the deployment type — a platform-global fact — not on your role, your tenant, or anything in the request body. It carries its own type rather than the generic forbidden precisely so an operator does not go and audit an RBAC assignment that is correct.

Common Causes

  • A SaaS-only per-tenant surface called on a customer-operated deployment. Per-tenant observability export, per-tenant Edition assignment and managed key-protection tier configuration exist only where there are many tenants; on a private-cloud or on-premise deployment the whole stack belongs to one customer and the per-tenant plane is inert.
  • A deployment-wide surface called on a SaaS deployment. The deployment-wide verified email-domain set and the deployment-wide trusted-issuer registry are offered only where the operator also owns the workloads and identities involved; on SaaS each tenant declares its own.

Response Example

{
  "type": "https://docs.ankatech.co/errors/deployment-not-supported",
  "title": "Deployment Not Supported",
  "status": 403,
  "detail": "Per-tenant observability export is available only on a SaaS deployment.",
  "instance": "/api/v3/admin/platform/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/observability/entitlement",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the detail: each refusing surface supplies its own fixed sentence naming the surface and the deployment class it belongs to.
  2. Do not change the caller's scopes or roles — this refusal is independent of them and a role change will not lift it.
  3. Use the plane that this deployment does offer. Where a deployment-wide declaration is refused, declare it on the tenant that needs it; where a per-tenant surface is refused, the environment-wide configuration already governs every tenant.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.