Keystore Secret-Key Entry

URI: https://docs.ankatech.co/errors/keystore-secret-key-entry
HTTP Status: 400 Bad Request

When you see this

The keystore holds a secret-key entry. A keystore import keeps private keys and trusted certificates only, so a secret-key entry is refused, and it is never decrypted. Nothing is imported, not even the entries the keystore holds besides it.

The type is distinct from Invalid Input, so a caller tells this refusal apart by its type (RFC 9457 §3.1.1), never by parsing detail. The detail names nothing of the file, its aliases or its password.

Which route answers with this type

This type originates in the Core API keystore reader. The published routes are the Admin API routes below, which relay the refusal with the same 400, the same type and the same detail:

The preview refuses the same keystore with the same type and detail.

Response Example

{
  "type": "https://docs.ankatech.co/errors/keystore-secret-key-entry",
  "title": "Keystore holds a secret-key entry",
  "status": 400,
  "detail": "Keystore refused: secret-key entries are not imported; remove them",
  "instance": "/api/v3/admin/tenants/00000000-0000-0000-0000-000000000001/keys/import-keystore",
  "timestamp": 1761492000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

1. Remove the secret-key entries from the keystore (for example with keytool -delete -alias <alias>).
2. Import the keystore again.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.