Keystore Derivation Budget Exceeded

URI: https://docs.ankatech.co/errors/keystore-derivation-budget-exceeded
HTTP Status: 400 Bad Request

When you see this

The keystore you asked to import declares more password-based key derivations, in total, than one import may run. Opening a PKCS#12 keystore runs one derivation for its integrity MAC, two for each encrypted SafeContents and one for each shrouded key, and each derivation costs as many hash iterations as the file declares. The platform adds up what the file declares as it reads it, before running any derivation it counts, so a keystore over the budget is refused before the derivation that would cross it runs. Nothing is imported.

The type is distinct from Invalid Input, so a caller tells this refusal apart by its type (RFC 9457 §3.1.1), never by parsing detail. The detail names nothing of the file, its aliases or its password.

Which route answers with this type

This type originates in the Core API keystore reader. The published routes are the Admin API routes below, which relay the refusal with the same 400, the same type and the same detail:

A keystore import preview (analyzeKeystore) does not refuse such a keystore: it answers 200 with the budget reported as exceeded and no alias analysed, so you learn it before you import.

Response Example

{
  "type": "https://docs.ankatech.co/errors/keystore-derivation-budget-exceeded",
  "title": "Keystore derivation budget exceeded",
  "status": 400,
  "detail": "Keystore refused: its key derivations exceed what one import may run; split it into smaller keystores and import each one",
  "instance": "/api/v3/admin/tenants/00000000-0000-0000-0000-000000000001/keys/import-keystore",
  "timestamp": 1761492000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

1. Split the keystore into several smaller keystores and import each one.
2. Or export it again with fewer entries or lower iteration counts; the detail names no count of the file.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.