Skip to content

Deployment Secret Not Configured

URI: https://docs.ankatech.co/errors/deployment-secret-not-configured
HTTP Status: 404 Not Found

When you see this

A deployment secret was requested for a setting key that has no sealed envelope. The custody service found no stored ciphertext to unseal and fails closed. The custody key that was looked up stays server-side: the rendered detail is a fixed string, so the response cannot be used to probe which keys are configured.

Common Causes

  • The setting has never been written, so no envelope was ever sealed for it.
  • A consuming service resolved a secret for a key the operator has not yet populated in Platform Settings.
  • The envelope was removed when the deployment was reconfigured, and the consumer still resolves the old key.

Response Example

{
  "type": "https://docs.ankatech.co/errors/deployment-secret-not-configured",
  "title": "Deployment Secret Not Configured",
  "status": 404,
  "detail": "No secret is configured for the requested key",
  "instance": "/api/v3/admin/s2s/deployment-secrets/resolve",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "c58e3410-9b7d-42f6-8a01-6d24f9e07b13"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Write the secret through PUT /api/v3/admin/platform/settings/{key} — a writable-secret entry seals the value under the deployment KEK and is never returned on a read.
  2. Confirm the setting reports its presence afterwards; the read answers presence only, never the value.
  3. Retry the operation that needed the secret.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.