Skip to content

Derived Audience Unconfigured

URI: https://docs.ankatech.co/errors/derived-audience-unconfigured
HTTP Status: 503 Service Unavailable

When you see this

This deployment has no usable public edge base URL, so the audience a token from an external issuer would have to name cannot be derived. PUBLIC_EDGE_BASE_URL is unset, or it is not a URL with a scheme and a host.

"Unconfigured" here means unusable, which is wider than unset: a value that is present but is not a parseable absolute URL produces this same refusal.

503 rather than 500, and rather than a startup-readiness failure. The caller did nothing wrong, and this is not an internal fault — the deployment is missing one named setting, and the detail names it. Failing the service's readiness instead would take tenant management, key administration and policy down for every tenant over a value none of those paths reads.

The operation is refused rather than completed with an audience no workload could satisfy: an issuer whose published audience is wrong refuses every token with a 401 naming nothing.

Common Causes

  • PUBLIC_EDGE_BASE_URL was never set for this environment.
  • The value is set to something that is not an absolute URL with a scheme and a host — a bare hostname, a path, or a placeholder left in the template.
  • A newly created environment where the edge URL was not derived during provisioning.

Response Example

{
  "type": "https://docs.ankatech.co/errors/derived-audience-unconfigured",
  "title": "Derived Audience Unconfigured",
  "status": 503,
  "detail": "This deployment has no usable public edge base URL (PUBLIC_EDGE_BASE_URL is unset, or is not a URL with a scheme and a host), so the audience a token from an issuer would have to name cannot be derived. The operation is refused rather than completed with an audience no workload could satisfy: an issuer whose published audience is wrong refuses every token with a 401 naming nothing. Configure PUBLIC_EDGE_BASE_URL and retry.",
  "instance": "/api/v3/admin/tenants/3f9a1b62-5d47-4c8e-b0a2-91d7e4f60cc5/workload-identity/issuers",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Set PUBLIC_EDGE_BASE_URL for this environment to the absolute HTTPS URL of its public edge, including scheme and host.
  2. Apply the configuration change and let the services pick it up, then retry the request.
  3. Issuers already declared are unaffected and need no change — this refusal blocks the operations that must derive an audience, not the trust already in place.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.