Skip to content

Last Local Account

URI: https://docs.ankatech.co/errors/federated-link-last-local-account
HTTP Status: 422 Unprocessable Entity

When you see this

Binding this account would leave the tenant with no account able to authenticate locally. Every remaining administrator would depend on the identity provider, so an outage or a misconfiguration there would lock the tenant out of its own console with no way back in.

The refusal is raised on the declare leg of federated account linking, POST /api/v3/admin/tenants/{tenantId}/users/{userId}/federated-link-intent. Nothing was written: no intent exists, no notification was sent, and the target account is unchanged.

This is a different refusal from Break-Glass Account Protected, even though both are 422 and both concern lockout. This one is fixable — retain or create another local account and the same request succeeds. That one never is.

Common Causes

  • The target is the tenant's only account that still authenticates with a local password.
  • Every other local account in the tenant has already been bound to a federated identity, or is not in a state that lets it authenticate.

Response Example

{
  "type": "https://docs.ankatech.co/errors/federated-link-last-local-account",
  "title": "Last Local Account",
  "status": 422,
  "detail": "Binding this account would leave the tenant with no account that can authenticate locally. Retain or create another local account first.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/users/8c4f1a02-77d5-4e19-b3ac-51e6d9f0a742/federated-link-intent",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Create a second administrator account in the tenant that authenticates locally, or unlink one that is already federated.
  2. Confirm that account is active and can sign in with its own credentials.
  3. Re-submit the link intent for the original account.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.