Skip to content

Key Material Without Operations

URI: https://docs.ankatech.co/errors/key-material-without-operations
HTTP Status: 409 Conflict

When you see this

A key import (POST /api/v3/admin/tenants/{tenantId}/keys/import-key) named a key that already exists, and the key's stored current material declares no permitted operation: its key_ops is empty. A key with no permitted operation cannot encrypt, decrypt, sign or verify, and a re-import cannot give it one, so the import was refused. Nothing was written.

A current release never stores such a material: every key is created with the operations its algorithm and request allow. A material stored by an earlier release can be in this state.

Response Example

{
  "type": "https://docs.ankatech.co/errors/key-material-without-operations",
  "title": "Key Material Without Operations",
  "status": 409,
  "detail": "Key \"partner-verify-2026\" cannot be re-imported: its stored current material has no permitted operations. Rotate the key to give it a new current material with its own operations, or delete and recreate it.",
  "instance": "/api/v3/admin/tenants/9b2d4c1a-7e3f-4a8b-b6d2-1f0e5c3a9d47/keys/import-key"
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. There is no Retry-After: retrying cannot succeed.

How to Resolve

  1. Rotate the key (POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/rotations). Rotation gives the key a new current material under the same key identifier, with the operations stated in the rotation request or, when none are stated, the algorithm's own.
  2. Delete and recreate the key when its identifier can be reissued, then import or create it again with its operations.

Related: Key Protection Limit Reached — the other refusal a re-import of an existing key can receive; Invalid Key State.