Skip to content

Key Protection Backend Bind Contradicted

URI: https://docs.ankatech.co/errors/key-protection-backend-bind-contradicted
HTTP Status: 409 Conflict

When you see this

First-run completion was attempted on an environment whose recorded key-material bind is contradicted by the backend itself. The bootstrap key metadata rows are written host-side by the activation command, so they are a claim about the backend rather than proof of it; when the corroborating live key resolve fails, the recorded state says bound while the backend holds nothing. Completion is refused fail-closed and the platform is not marked provisioned. extensions.setupState carries KEY_BACKEND_BIND_CONTRADICTED.

Common Causes

  • The bootstrap tenant key metadata rows exist but the corresponding keys are absent from the backend — for example the token was reinitialised, replaced or restored from a state that predates activation.
  • The environment was pointed at a different backend instance than the one the host activation provisioned.

An unbound backend does not produce this error: readiness is decoupled from the key-material bind, and a backend that merely cannot be reached yields no evidence and does not trigger the refusal.

Response Example

{
  "type": "https://docs.ankatech.co/errors/key-protection-backend-bind-contradicted",
  "title": "Recorded key protection backend state contradicted",
  "status": 409,
  "detail": "The recorded key-protection backend state is contradicted by the backend itself. This environment cannot be marked ready; repair it from the host and try again.",
  "instance": "/api/v3/admin/platform/setup/complete",
  "timestamp": 1730000000,
  "extensions": {
    "setupState": "KEY_BACKEND_BIND_CONTRADICTED",
    "requestId": "17e6b4c9-8035-42fa-b8d1-6c907e2a4f58"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Repair the environment from the host — re-run the host activation command that provisions the bootstrap key-encryption keys. This condition is never remediated through the API.
  2. Confirm the environment points at the backend instance the activation provisioned.
  3. Re-run POST /api/v3/admin/platform/setup/complete. Retrying without repairing cannot succeed: the condition is a durable conflict between recorded and actual state, which is why it is a 409 rather than a 503.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.