Skip to content

Identity Provider Not Eligible

URI: https://docs.ankatech.co/errors/federated-link-provider-not-eligible
HTTP Status: 422 Unprocessable Entity

When you see this

The identity provider named in the request cannot be used for account linking in this tenant.

The refusal is raised on the declare leg of federated account linking, POST /api/v3/admin/tenants/{tenantId}/users/{userId}/federated-link-intent. Nothing was written: no intent exists, no notification was sent, and the target account is unchanged.

One type and one body, for every cause

This refusal is deliberately indistinguishable across all of its causes — an identifier that matches no provider, a provider that is disabled, one declared on the other plane, one of a kind that does not support linking, and an LDAP provider all produce exactly this response. Separating them would let a tenant administrator enumerate the deployment's provider inventory by guessing identifiers, and naming the kind would additionally disclose which protocol a provider speaks. A 404 for an unknown identifier would be the same disclosure wearing a different status.

The specific cause is recorded server-side. Quote the correlation identifier from the response when you need an operator to look it up.

Common Causes

  • The provider identifier in the request does not name a provider this tenant may use.
  • The provider exists but is disabled.
  • The provider is declared on the platform plane rather than for this tenant.
  • The provider is of a kind that does not support account linking.

Response Example

{
  "type": "https://docs.ankatech.co/errors/federated-link-provider-not-eligible",
  "title": "Identity Provider Not Eligible",
  "status": 422,
  "detail": "The named identity provider cannot be used for account linking in this tenant.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/users/8c4f1a02-77d5-4e19-b3ac-51e6d9f0a742/federated-link-intent",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Open the tenant's identity-provider list in the console and select a provider from it rather than supplying an identifier by hand. The list shows only providers this tenant may actually use.
  2. Confirm the provider you want is enabled.
  3. If the provider you expect is absent from the list, ask a platform administrator whether it is declared for this tenant and whether its kind supports linking.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.