Invalid Key State

URI: https://docs.ankatech.co/errors/invalid-key-state
HTTP Status: 409 Conflict

When you see this

The requested cryptographic operation cannot be performed because the key is in an invalid state for the operation. The key exists but its current lifecycle state prevents the requested usage.

Common Causes

• Revoked key
  Trying to perform operations with a key that has been explicitly revoked.

• Suspended key
  The key has been temporarily suspended and cannot be used until reactivated.

• Pre-activation key
  Attempting to use a key before its activation date has been reached.

• Destroyed key material
  The key metadata exists but the cryptographic material has been destroyed.

• Usage count that could not be decided
  An encryption or signature on a key with a usage limit could not be counted because the key's material kept changing under the request — a rotation or a limit change, retried once — or a rotation replaced the material the request resolved before its use was counted. Nothing was produced; the request can be repeated against the key's new state.

• Metadata update on a key without current material
  A key-metadata update names a field stored on the key's current material (exportable, expiresAt, softLimitExpiration, maxUsageLimit, softUsageLimit) while the key has none: it is revoked, archived or pending destruction. The detail names every such field and the key's status, and nothing is written. The key's displayName and description can still be changed.

• Rotation not allowed in the key's lifecycle state
  A rotation, or its admissibility preview, on a key whose state the tenant's lifecycle policy does not allow rotating: the policy's ROTATE cell is not ALLOW for the key's status or for its current material's status — for example a suspended key under the default and strict policies — or the policy cannot be read. The detail names the key and both states, and nothing is changed.

• Wrong operation for key state
  Attempting operations not allowed in the current state (e.g., trying to encrypt with a decrypt-only key in post-rotation state).

Not this problem: an expired or usage-exhausted key. An encryption or signature with a key past its expiry is refused with Key Material Expired, and one with a key that has used up its usage limit with Key Material Usage Exhausted. Such a key keeps its status and still decrypts and verifies. A metadata update of a limit the key has already reached is refused with Key Protection Limit Reached.

How to Resolve

1. Check key status

   • Query the key details endpoint to verify the current state.
   • Review the key's lifecycle status: ACTIVE, SUSPENDED, EXPIRED, REVOKED, DESTROYED.

2. For a rotation refused by the lifecycle policy

   • Reactivate a suspended key first, or ask an administrator to review the tenant's lifecycle policy.

3. For revoked keys

   • Revocation is permanent; generate a new key.
   • Historical decryption/verification may be permitted based on policy.

4. For suspended keys

   • Contact an administrator to reactivate the key.
   • Investigate why the key was suspended (security incident, audit requirement).

5. For a usage count that could not be decided

   • Repeat the request; it is decided against the key's current material.

6. For pre-activation keys

   • Wait until the activation date.
   • Verify the activation timestamp is correctly set.

Response Example

{
  "type": "https://docs.ankatech.co/errors/invalid-key-state",
  "title": "Invalid Key State",
  "status": 409,
  "detail": "Rotation refused: the lifecycle policy of this tenant does not allow rotating key mykey-2024 while its alias is SUSPENDED and its current material is PRIMARY. Nothing was changed.",
  "instance": "/api/v3/admin/tenants/9b2d4c1a-7e3f-4a8b-b6d2-1f0e5c3a9d47/keys/mykey-2024/rotations",
  "correlationId": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

Key Lifecycle States

For more information about key lifecycle management, see the Key Management on the Developer Hub documentation.