Skip to content

Managed Backend Tier Key Material Present

URI: https://docs.ankatech.co/errors/managed-tier-key-material-bound
HTTP Status: 409 Conflict

When you see this

The reconfiguration you requested would move the ANKA-managed tier's resolved key-encryption key while at least one tenant routed to that tier already holds key material. Moving the key would strand every blob already wrapped under the previous one, so the change is refused. Unlike a reconfiguration already in progress, this condition is durable for as long as the material exists — retrying will not clear it.

Common Causes

  • Selecting a different key-protection backend for a tier whose tenants have already created keys.
  • Declaring a previously undeclared tier as a backend other than the one it already resolves to, once its tenants hold material.

Response Example

{
  "type": "https://docs.ankatech.co/errors/managed-tier-key-material-bound",
  "title": "Managed Backend Tier Key Material Present",
  "status": 409,
  "detail": "Tenants on this managed key-protection tier already hold key material, so a change that would move the tier's key-encryption key is refused. Nothing was changed by this request. A selection that does not move the tier's key-encryption key is still permitted.",
  "instance": "/api/v3/admin/platform/key-backend/tiers/PROFESSIONAL",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Do not retry — the refusal is not transient. It clears only when the tier's tenants no longer hold key material.
  2. A selection that provably does not move the tier's resolved key-encryption key is still permitted: re-selecting the backend the tier already holds, or declaring an undeclared tier to be exactly the backend it already resolves to.
  3. If the tier genuinely must run on a different backend, plan the move as a key-custody migration rather than as a tier edit.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.