Skip to content

Federated Credential Recovery

URI: https://docs.ankatech.co/errors/federated-credential-recovery
HTTP Status: 409 Conflict

When you see this

A platform recovery authority asked to perform an assisted recovery of an identity whose memberships all sign in through an external identity provider (OIDC or SAML). Nothing was changed.

An assisted recovery replaces credentials the platform holds: it invalidates the identity's passkeys, authenticator app, recovery codes and password, and hands over a single-use enrolment token so the person can enrol a new authenticator. An identity that signs in only through an OIDC or SAML provider holds no credential here to replace; its credential lives with that provider, under the provider's own recovery process. Recovering it here would not restore access, and would create a local credential the person's organization does not govern.

An identity that signs in through an LDAP directory is recovered here: the directory verifies the password, and the platform holds the second factor that the recovery replaces.

Common Causes

  • Every membership of the identity is linked to an OIDC or SAML identity provider.
  • A tenant administrator filed a recovery request for a member who signs in through the tenant's single sign-on.

Response Example

{
  "type": "https://docs.ankatech.co/errors/federated-credential-recovery",
  "title": "Federated Credential Recovery",
  "status": 409,
  "detail": "This identity signs in through an external identity provider. Recover access with that provider.",
  "instance": "/api/v3/admin/platform/identity-recoveries",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Ask the person's organization to recover the account in its identity provider.
  2. Once the provider admits the person again, they sign in to the console through single sign-on as before. No action on the platform is needed.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.