Skip to content

Federated Role Not Assignable

URI: https://docs.ankatech.co/errors/federated-role-not-assignable
HTTP Status: 422 Unprocessable Entity

When you see this

An admission rule or group-to-role mapping names an ANKASecure role that exists and is human-assignable, but cannot be held inside a tenant of this tenant's type. The same condition is refused in two places with the same status and the same type: when an operator declares the rule or mapping, and again when a federated login tries to consume it.

Common Causes

  • A TENANT_* composite role, or a key-management or crypto role, named for the platform tenant.
  • A PLATFORM category role, or a platform-exclusive scope-shaped role, named for a regular tenant.
  • A role in a category no tenant type accepts — SECURE, STREAM and S2S_INTERNAL are refused in both.
  • A role whose assignability changed after the rule that names it was declared.

Response Example

{
  "type": "https://docs.ankatech.co/errors/federated-role-not-assignable",
  "title": "Federated Role Not Assignable",
  "status": 422,
  "detail": "Role 'TENANT_ADMIN' (category=ADMIN) cannot be assigned in the platform tenant. Allowed categories: PLATFORM, AUDIT, ADMIN, or AUTH (excluding TENANT_* composites and key-management/crypto roles).",
  "instance": "/api/v3/admin/tenants/7c9e6679-7425-40de-944b-e07fc1f90ae7/idp/mappings",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail names only the submitted role, its category, the tenant type and the accepted categories. It carries no tenant identifier, no rule identifier and no other tenant's role, so the refusal cannot be used to enumerate a foreign catalogue.

How to Resolve

  1. Read the detail — it lists the categories this tenant type accepts.
  2. Name a role from one of those categories in the admission rule or mapping.
  3. If the intent was to grant platform authority, declare the rule on the platform tenant's provider rather than on a regular tenant's.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.