Skip to content

Key Backend Not Admissible

URI: https://docs.ankatech.co/errors/key-backend-not-admissible
HTTP Status: 422 Unprocessable Entity

When you see this

A per-tenant BYOK declare or bind named a key-protection backend that this deployment does not admit for this tenant. The token is one the platform supports — that is why this is a 422 and not a schema rejection — but the composition of the tenant's entitlement, the deployment policy and the operator's allowlist does not admit it here.

Common Causes

  • The tenant is not entitled to bring its own key-protection backend.
  • The deployment's own policy refuses this backend class for this tenant.
  • The operator's BYOK allowlist (ankasecure.key-protection.byok.allowed-backends) does not include the named backend.

The body is byte-identical for every refused token and every refusing factor: it carries no allowlist contents, no required assurance level, no tenant id and no backend brand. Which factor refused is recorded on the audit trail, not in the response.

Response Example

{
  "type": "https://docs.ankatech.co/errors/key-backend-not-admissible",
  "title": "Key Backend Not Admissible",
  "status": 422,
  "detail": "The declared key-protection backend is not admissible on this deployment.",
  "instance": "/api/v3/admin/tenants/7d1c9b40-52e8-4a36-9f07-c3b81e6d240a/key-backend/byok",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "d6194e72-3f0b-4a85-81c9-4b70e2ad5163"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Rehearse the declaration with POST /api/v3/admin/tenants/{tenantId}/key-backend/byok/validate before committing it, so admissibility is settled before the write.
  2. Ask the platform operator to review the tenant's entitlement and the deployment BYOK allowlist (ankasecure.key-protection.byok.allowed-backends). The response deliberately does not say which factor refused; the audit trail carries that detail.
  3. Declare a backend the deployment does admit for this tenant, then bind it.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.