Skip to content

Key Object Still In Use

URI: https://docs.ankatech.co/errors/kek-destruction-key-object-in-use
HTTP Status: 409 Conflict

When you see this

A platform administrator asked to destroy one of a tenant's retired key-encryption keys at the provider or HSM that holds it, and the request was refused. The key keeps its status, the provider was not asked to destroy anything, and the refusal is recorded in the audit trail as DENIED.

A tenant key-encryption key is destroyed at its provider or HSM, never only in the platform's records. A destruction request moves a RETIRED key to PENDING_DESTRUCTION, and the key becomes DESTROYED only once a read of the provider confirms it gone. Until then the destruction can be cancelled, which returns the key to RETIRED.

Common Causes

  • A tenant that returned to a carrier it had left may hold the key object it left there under a second lineage entry. The key object is destroyed only when every entry naming it is retired.

Response Example

{
  "type": "https://docs.ankatech.co/errors/kek-destruction-key-object-in-use",
  "title": "Key Object Still In Use",
  "status": 409,
  "detail": "The key object of this key-encryption key is also the tenant's key-encryption key under another lineage entry that is not retired. Nothing was changed.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/keks/3c1f7a9e-2b44-4e0d-8f6a-91d2c7b5e0aa/destroy",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the tenant's lineage and find the other entry naming the same key: when it is retired too and past its retention, the destruction moves both together.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.