Skip to content

Key Backend Already Bound

URI: https://docs.ankatech.co/errors/key-backend-already-bound
HTTP Status: 409 Conflict

When you see this

A per-tenant Edition assignment or clear would change the tenant's effective ANKA-managed key-material backend, and the tenant already holds key material. The immutability authority is the key-material-exists read against core-api: once the tenant has wrapped its first key, the backend it is wrapped under can no longer change, because changing it would strand that material. The refusal happens before anything is persisted.

Common Causes

  • Assigning a different Edition to a tenant that has already created at least one key, where the new Edition maps to a different managed backend.
  • Clearing a tenant's Edition override after the tenant has key material, so the effective backend would revert to a different one.

Note that a same-backend relabel is permitted: an Edition change that maps to the same backend is not refused. This error is the managed-Edition plane; the bring-your-own-backend plane answers tenant-backend-already-bound for its own equivalent condition.

Response Example

{
  "type": "https://docs.ankatech.co/errors/key-backend-already-bound",
  "title": "Tenant Key-Material Backend Immutable",
  "status": 409,
  "detail": "This tenant already holds key material; its key-material backend can no longer be changed.",
  "instance": "/api/v3/admin/platform/tenants/7d1c9b40-52e8-4a36-9f07-c3b81e6d240a/key-backend/edition",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "5a80c317-be42-4d69-90fb-27e4d1c85b03"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the tenant's effective backend with GET /api/v3/admin/platform/tenants/{tenantId}/key-backend/precedence and compare it with the backend the target Edition maps to.
  2. If both map to the same backend, the assignment is a relabel and will be accepted; if they differ, the change cannot be made for this tenant.
  3. Provision a new tenant on the intended Edition instead. Re-pointing a tenant that already holds key material is not offered, because it would orphan that material.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.