Skip to content

Invalid Trusted Issuer Target

URI: https://docs.ankatech.co/errors/invalid-trusted-issuer-target
HTTP Status: 422 Unprocessable Content

When you see this

A platform-on-behalf trusted-issuer or binding write named the ROOT platform tenant as its target. The ROOT tenant has no per-tenant trust registry, because the deployment's own registry is its registry.

The request is syntactically valid and the caller is authorized; it is the target that is not admissible, which is why this is a 422 and not a 400 or a 403.

It is a distinct type from the delivery-provider target refusal deliberately: that one says the ROOT tenant has no per-tenant delivery chain, this one says it has no per-tenant trust registry. An operator who lands here has the wrong URL, and a message pointing them at delivery providers costs them the time it takes to rule that out.

Common Causes

  • Using the ROOT platform tenant's identifier in a per-tenant workload-identity route.
  • Iterating over every tenant, including ROOT, when applying a trust declaration.
  • Intending a deployment-wide declaration and reaching for the per-tenant route instead.

Response Example

{
  "type": "https://docs.ankatech.co/errors/invalid-trusted-issuer-target",
  "title": "Invalid Trusted Issuer Target",
  "status": 422,
  "detail": "The ROOT platform tenant is not a valid target for a per-tenant trusted-issuer write; the deployment's own registry is the deployment plane",
  "instance": "/api/v3/admin/platform/tenants/00000000-0000-0000-0000-000000000001/workload-identity/issuers",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The body is identical whether or not the ROOT tenant holds any row, and it names no configuration.

How to Resolve

  1. To trust an issuer across the whole deployment, use the deployment-plane route rather than a per-tenant one.
  2. To trust an issuer for a specific customer, name that customer's tenant identifier — never the ROOT platform tenant.
  3. If you are iterating over tenants programmatically, exclude the ROOT platform tenant from the per-tenant trust surface.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.