Skip to content

Last Active Anchor

URI: https://docs.ankatech.co/errors/last-active-anchor
HTTP Status: 409 Conflict

When you see this

Retiring this anchor would drop the number of ACTIVE TSA trust anchors to zero while one or more tenants are currently stamping — that is, their effective TSA usage mode is REQUIRED. The deployment would be left with no trusted time-stamping authority, and signing for those tenants would start to fail. The retirement is rolled back. The body carries one scalar extension, activeTenantCount, so you can see the blast radius; no tenant is ever identified.

Common Causes

  • The last ACTIVE anchor was retired before its replacement had been uploaded.
  • A CA rotation was performed in the wrong order: the outgoing anchor was retired before the incoming one became ACTIVE.
  • Two retirements ran concurrently. Each saw more than one ACTIVE anchor and passed its pre-check, so the count is re-asserted inside the transaction after the state change and the later one is rolled back.

Response Example

{
  "type": "https://docs.ankatech.co/errors/last-active-anchor",
  "title": "Conflict",
  "status": 409,
  "detail": "This is the last ACTIVE trust anchor and one or more tenants are currently stamping. Retiring it would leave the deployment with no trusted TSA. Retry with override=true to proceed.",
  "instance": "/api/v3/admin/platform/tsa/trust-anchors/7f1c2a90-3d44-4b21-9d0e-1c2f6b8a4e55/retire",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000",
    "activeTenantCount": 3
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Upload the replacement CA certificate first so it is ACTIVE alongside the outgoing one, then retire the outgoing anchor. Several ACTIVE anchors are supported precisely to allow this overlap.
  2. If you intend to stop time-stamping altogether, move the affected tenants off a REQUIRED TSA usage policy first. Once no tenant is stamping, the retirement is allowed with no override.
  3. To proceed anyway, repeat the request with ?override=true. That is a deliberate outage of qualified time-stamping for the tenants counted in activeTenantCount: their signing requests will be refused with 503 tsa-unavailable.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.