Skip to content

Key State Not Admissible

URI: https://docs.ankatech.co/errors/key-state-not-admissible
HTTP Status: 422 Unprocessable Entity

When you see this

The key you referenced from an internal crypto use case exists in your tenant but is not in a state that can carry one. Two independent tiers are checked and either is enough to refuse: the key's own alias may be logically deleted, or every material version under it may be destroyed, leaving no usable key bytes. A kid that carries no alias at all — neither live nor tombstoned — is answered 404 instead, so reaching this 422 means the key is there. The detail names the role — SINGLE, SOURCE or TARGET — so a cross-kid request learns which of its two references failed.

Common Causes

  • The referenced kid was deleted; a tombstoned alias is refused here rather than reported as missing.
  • The alias is live but every material version under it has been destroyed, so no representative material remains.
  • The alias resolves to the DELETED_LOGICAL projected status.

Response Example

{
  "type": "https://docs.ankatech.co/errors/key-state-not-admissible",
  "title": "Key State Not Admissible",
  "status": 422,
  "detail": "The referenced key (role SOURCE) is not in a state that can carry a use case. Reference a key that has not been deleted and still holds material.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/internal-crypto-use-cases",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the role in the detail to identify which reference was refused on a cross-kid request.
  2. Check that kid's state through the key read endpoint: a deleted alias, or one whose material versions are all destroyed, cannot carry a use case.
  3. Reference a key that is not deleted and still holds material, or provision a new key for the use case.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.