Internal Use Case Not Renewable

URI: https://docs.ankatech.co/errors/internal-use-case-not-renewable
HTTP Status: 409 Conflict

When you see this

You asked to renew an Internal Crypto Use Case, renewInternalCryptoUseCase (POST /api/v3/admin/tenants/{tenantId}/internal-crypto-use-cases/{useCaseId}/renew), and the use case is REVOKED. Nothing changed.

Renewal extends a use case's validity window by one year and restores an EXPIRED use case to ACTIVE, with the same actor, the same credential and the same grants. A revoked use case has none of those left: its revocation revoked its grants and its credential, disabled its actor and closed its Exchange Context. There is no workload to restore, so a revoked use case is never renewed. A retry gets the same answer.

ACTIVE, SUSPENDED and EXPIRED use cases are all renewable:

This is a distinct 409 from Concurrent Modification, which means a stale optimistic-lock version and succeeds on a retry after a re-read.

Common Causes

• Renewing a use case that was revoked from the console or with revokeInternalCryptoUseCase.
• Renewing a use case that ended because a key it named was destroyed, or because its Application was deleted: both revoke the use case.
• A script that renews every use case of a tenant, revoked ones included (list them with status=REVOKED to tell them apart).

Response Example

{
  "type": "https://docs.ankatech.co/errors/internal-use-case-not-renewable",
  "title": "Internal Use Case Not Renewable",
  "status": 409,
  "detail": "The Internal Crypto Use Case is REVOKED; a revoked use case is never renewed. Provision a new use case if the workload is still required.",
  "instance": "/api/v3/admin/tenants/0f3b8c2e-5d41-4a7e-9b1c-6e2f4d8a9c10/internal-crypto-use-cases/aaaaaaaa-1111-2222-3333-444444444444/renew",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json, following RFC 9457 Problem Details. The detail is fixed text and names no identifier.

How to Resolve

1. Read the use case (getInternalCryptoUseCase) and confirm status is REVOKED; terminalCause says why it ended.
2. If the workload is still needed, provision a new use case with createInternalCryptoUseCase. It gets a new actor and a new credential, so the application must use the new credential.
3. Data protected under the revoked use case's key stays decryptable by any use case or grant over the same key: the revocation did not touch the key.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.