Skip to content

Break-Glass Account Protected

URI: https://docs.ankatech.co/errors/federated-link-target-protected
HTTP Status: 422 Unprocessable Entity

When you see this

You asked to bind the deployment's break-glass platform administrator to a federated identity, and the platform refused. That account is the deployment's recovery path: if the identity provider is unreachable, misconfigured or mid-migration, it is the account that can still sign in. Binding it to an external identity removes that path at exactly the moment it is needed.

The refusal is raised on the declare leg of federated account linking, POST /api/v3/admin/tenants/{tenantId}/users/{userId}/federated-link-intent. Nothing was written: no intent exists, no notification was sent, and the target account is unchanged.

Common Causes

  • The selected account is the break-glass platform administrator. The guard is keyed on the account's immutable identifier, never on its email address, so renaming or re-addressing the account does not change the outcome.

Response Example

{
  "type": "https://docs.ankatech.co/errors/federated-link-target-protected",
  "title": "Break-Glass Account Protected",
  "status": 422,
  "detail": "This account is the deployment's break-glass administrator and cannot be bound to a federated identity.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/users/8c4f1a02-77d5-4e19-b3ac-51e6d9f0a742/federated-link-intent",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Choose a different account. Every other administrator in the tenant can be bound normally.
  2. If the intent is to give this person federated sign-in, create a second administrator account for them and bind that one. The break-glass account stays local by design.
  3. Do not attempt to work around the refusal by renaming the account — the guard does not read the name.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.