Key Algorithm Incompatible

URI: https://docs.ankatech.co/errors/key-algorithm-incompatible
HTTP Status: 422 Unprocessable Entity

When you see this

A key you referenced from an internal crypto use case has an algorithm that cannot carry one of the declared operations. The check is separate from the purpose tier and runs after it: the algorithm's own key operations must cover what the declared operation requires of that reference's role. The detail names the operation and the role — SINGLE, SOURCE or TARGET — but deliberately not the algorithm, which is server-side knowledge about a key you did not describe in the request.

Common Causes

A declared operation requires a key operation the referenced key's algorithm family does not provide.
On a cross-kid use case, the target key's algorithm cannot perform the half of the operation the target side carries.
A narrow imported key — for example an encrypt-only public key — was referenced for a role that needs more than it offers.

Response Example

{
  "type": "https://docs.ankatech.co/errors/key-algorithm-incompatible",
  "title": "Key Algorithm Incompatible",
  "status": 422,
  "detail": "Operation 'REENCRYPT' is not supported by the algorithm of the referenced key (role TARGET). Reference a key whose algorithm carries this operation, or provision one for it.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/internal-crypto-use-cases",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

Read the role in the detail to identify which reference was refused.
Read that key's algorithm through the key read endpoint and confirm it supports the operation you declared for that role.
Reference a key whose algorithm carries the operation, or provision one for it.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.