Skip to content

Key Object Not Resolved

URI: https://docs.ankatech.co/errors/kek-destruction-object-unresolved
HTTP Status: 409 Conflict

When you see this

A platform administrator asked to destroy one of a tenant's retired key-encryption keys at the provider or HSM that holds it, and the request was refused. The key keeps its status, the provider was not asked to destroy anything, and the refusal is recorded in the audit trail as DENIED.

A tenant key-encryption key is destroyed at its provider or HSM, never only in the platform's records. A destruction request moves a RETIRED key to PENDING_DESTRUCTION, and the key becomes DESTROYED only once a read of the provider confirms it gone. Until then the destruction can be cancelled, which returns the key to RETIRED.

Common Causes

  • The HSM holds more than one object under the recorded label, so the platform cannot tell which one to destroy and destroys none.
  • The HSM holds one object under the recorded label, but it carries another identifier than the one recorded, so it is not the key the platform created.
  • The HSM holds no object under the recorded label, but an object under another label carries the recorded identifier (CKA_ID), so the platform cannot tell whether the key was relabelled and destroys nothing.
  • The key's recorded name is not one the platform gives a key it creates.
  • The recorded identifier ends in a 0x00 byte. A token may store such an identifier without its trailing zero bytes, so neither a lookup by it nor a comparison is conclusive, and the platform destroys nothing.
  • An HSM token this environment has claimed on which neither the recorded label nor the recorded identifier finds an object is not this refusal: the key is already gone, and the destruction is recorded and then confirmed by the destruction poll.

Response Example

{
  "type": "https://docs.ankatech.co/errors/kek-destruction-object-unresolved",
  "title": "Key Object Not Resolved",
  "status": 409,
  "detail": "The HSM holds more than one object under the key-encryption key's recorded label, or one carrying another identifier, so nothing was destroyed. Nothing was changed.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/keks/3c1f7a9e-2b44-4e0d-8f6a-91d2c7b5e0aa/destroy",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Inspect the token with the HSM vendor's tools. Remove a duplicate object outside the platform only once you know which one is the key-encryption key, then ask again.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.