Skip to content

Deployment Secret Not Configured

URI: https://docs.ankatech.co/errors/deployment-secret-not-configured
HTTP Status: 404 Not Found

When you see this

A deployment secret was requested for a setting key that has no sealed envelope. The custody service found no stored ciphertext to unseal and fails closed. The custody key that was looked up stays server-side: the rendered detail is a fixed string, so the response cannot be used to probe which keys are configured.

Common Causes

  • The setting has never been written, so no envelope was ever sealed for it.
  • A consuming service resolved a secret for a key the operator has not yet populated in Platform Settings.
  • The envelope was removed when the deployment was reconfigured, and the consumer still resolves the old key.

Response Example

{
  "type": "https://docs.ankatech.co/errors/deployment-secret-not-configured",
  "title": "Deployment Secret Not Configured",
  "status": 404,
  "detail": "No secret is configured for the requested key",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "c58e3410-9b7d-42f6-8a01-6d24f9e07b13"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

This body is answered to the platform service that asked for the secret, not to an API client, so its instance names an internal call and is not reproduced here. What a caller observes is the operation that needed the secret failing.

How to Resolve

  1. Write the secret through PUT /api/v3/admin/platform/settings/{key} — a writable-secret entry seals the value under the deployment KEK and is never returned on a read.
  2. Confirm the setting reports its presence afterwards; the read answers presence only, never the value.
  3. Retry the operation that needed the secret.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.