Skip to content

Federation Not Included In This Edition

URI: https://docs.ankatech.co/errors/federation-not-entitled
HTTP Status: 403 Forbidden

When you see this

A tenant-scoped identity-federation change was refused because the tenant's licensed edition does not include tenant-configured federation. The caller is inside their own tenant boundary and holds the required scope — what is missing is commercial, not a permission.

Common Causes

  • The tenant's edition does not include tenant-configured identity federation.
  • The licence subsystem could not be read, so the effective edition fell to the least-privileged tier and the write was refused. The response never says which of the two applies.

Response Example

{
  "type": "https://docs.ankatech.co/errors/federation-not-entitled",
  "title": "Federation Not Included In This Edition",
  "status": 403,
  "detail": "Tenant-configured identity federation is included in the Enterprise edition. Contact your account manager to enable it for this tenant.",
  "instance": "/api/v3/admin/tenants/7c9e6679-7425-40de-944b-e07fc1f90ae7/idp",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The status is 403 because the capability is genuinely closed to this caller, but the dedicated type is what stops it reading as an RBAC problem — three other refusals on this surface (no token, insufficient scope, wrong tenant) must stay distinguishable from it and from each other. The body carries no scope name, no permission vocabulary and no licence-subsystem state.

Reads are never gated by this rule: an operator diagnosing a refused login can still see the configuration that refused it, and the entitlement read reports FLOORED when the licence could not be confirmed.

How to Resolve

  1. Query the tenant's federation entitlement read — it distinguishes "not included" from "could not be confirmed", which this refusal deliberately does not.
  2. If the entitlement reports FLOORED, the licence could not be read; the remedy is operational rather than commercial.
  3. Otherwise contact your account manager to have the edition upgraded for this tenant.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.