Skip to content

Key Purpose Incompatible

URI: https://docs.ankatech.co/errors/key-purpose-incompatible
HTTP Status: 422 Unprocessable Entity

When you see this

A key you referenced from an internal crypto use case carries an invariant purpose family that does not admit one of the declared operations. A SIGN_VERIFY key admits only signing and verification; an ENCRYPT_DECRYPT key admits only encryption and decryption. The detail names the operation, the reference's role — SINGLE, SOURCE or TARGET — and the purpose the key actually carries, so the next step is unambiguous.

Common Causes

  • ENCRYPT or DECRYPT declared over a key whose purpose is SIGN_VERIFY.
  • SIGN, VERIFY or RESIGN declared over a key whose purpose is ENCRYPT_DECRYPT.
  • On a cross-kid use case, the source and target were transposed so one side is asked for an operation its purpose does not admit.

Response Example

{
  "type": "https://docs.ankatech.co/errors/key-purpose-incompatible",
  "title": "Key Purpose Incompatible",
  "status": 422,
  "detail": "Operation 'ENCRYPT' is not admitted by the purpose of the referenced key (role SINGLE), which is restricted to SIGN_VERIFY operations. Reference a key of the matching purpose, or provision one for this operation.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/internal-crypto-use-cases",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the detail: it names the refused operation, the role of the reference that failed, and the purpose family that key carries.
  2. Reference a key of the matching purpose for that role, or provision one for the operation.
  3. On a cross-kid use case, confirm keyKid and targetKeyKid are the way round you intended before re-submitting.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.