Next Signing Key Not Yet Propagated

URI: https://docs.ankatech.co/errors/next-key-not-propagated
HTTP Status: 409 Conflict

When you see this

A platform administrator asked to rotate the user-token signing key set (POST /api/v3/admin/platform/token-signing-keys/actions/rotate) before the NEXT key had been published for the minimum propagation age of 300 seconds. A key signs only after every verifier has had time to cache it, so the rotation is refused and nothing is changed.

Common Causes

• A rotation or a revocation published a fresh NEXT key a few minutes ago, and a second rotation was requested straight after it.
• The platform was just initialized: the first NEXT key is published together with the first ACTIVE key.

Response Example

HTTP/1.1 409 Conflict
Content-Type: application/problem+json
Retry-After: 180

{
  "type": "https://docs.ankatech.co/errors/next-key-not-propagated",
  "title": "Next Signing Key Not Yet Propagated",
  "status": 409,
  "detail": "The next token signing key has not been published long enough to be promoted",
  "instance": "/api/v3/admin/platform/token-signing-keys/actions/rotate",
  "timestamp": 1790820120,
  "extensions": {
    "requestId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "rotationAvailableAt": "2026-10-01T02:05:00Z"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

Retry-After is the remaining wait rounded up to whole seconds, and extensions.rotationAvailableAt is the instant the list operation also reports. Both are computed on the server's clock.

How to Resolve

1. Wait until rotationAvailableAt, then rotate. The list operation returns the same instant together with asOf, the server instant of the answer, so the remaining wait is rotationAvailableAt - asOf without trusting the client's clock.
2. To withdraw a compromised ACTIVE key immediately, revoke it instead: a revocation of the ACTIVE key is not bound by the wait.

See Admin API — Platform Token Signing Keys^*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.