Skip to content

Observability Export Not Entitled

URI: https://docs.ankatech.co/errors/observability-not-entitled
HTTP Status: 403 Forbidden

When you see this

A tenant self-service observability-export write — creating, updating, rotating or deleting the tenant's own OTLP destination — was attempted for a tenant the platform has not entitled to configure its own observability backend. The entitlement is a platform-granted plan gate, evaluated after the tenant-boundary check and the SaaS gate and before any destination row is created or any secret is sealed.

Common Causes

  • The tenant's observability-export entitlement was never granted by the platform.
  • The entitlement was granted and has since been withdrawn.
  • A tenant administrator holding the correct scope and acting inside their own tenant assumes the scope alone is sufficient; the entitlement is a separate, platform-granted flag.

Response Example

{
  "type": "https://docs.ankatech.co/errors/observability-not-entitled",
  "title": "Observability Export Not Entitled",
  "status": 403,
  "detail": "This tenant is not entitled to configure its own observability backend.",
  "instance": "/api/v3/admin/tenants/9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d/observability-backends",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Ask the platform operator to grant this tenant the observability-export entitlement. More scopes will not lift the refusal — it is a plan gate, not an authorization failure.
  2. Reads of the tenant's observability surface are unaffected; only writes are gated.
  3. Once the entitlement is granted, re-submit the same request unchanged.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.