Ownership Recovery Identity Ineligible

URI: https://docs.ankatech.co/errors/ownership-recovery-identity-ineligible
HTTP Status: 409 Conflict

When you see this

Deployment-ownership recovery, run on the environment host with envctl.sh <env> recover-platform-access --identity <email>, named an identity it may not take over. It recovers only a platform administrator, or creates one for an address no identity holds. Nothing was changed, the refusal was recorded in the audit trail, and the command exits non-zero printing the detail.

Common Causes

The identity holds a membership in a tenant other than the platform tenant.
The platform identity holds no membership of the platform tenant.
The platform identity has not accepted its membership of the platform tenant: its enrolment token could never be completed.

An environment nobody has claimed yet answers instance-not-claimed instead: it has no platform administrator to recover.

Response Example

{
  "type": "https://docs.ankatech.co/errors/ownership-recovery-identity-ineligible",
  "title": "Ownership Recovery Identity Ineligible",
  "status": 409,
  "detail": "The named identity holds a membership outside the platform tenant, so deployment-ownership recovery cannot take it over. Name a platform identity, or a new address to create one. Nothing was changed.",
  "instance": "/api/v3/admin/platform/ownership-recovery",
  "timestamp": 1760951700,
  "extensions": {
    "requestId": "4e2a9c71-0b3d-4f58-a6e1-9d7c2b5f8e30"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

Run the command again naming a platform administrator's address.
Or name an address no identity holds: the recovery creates a platform administrator holding PLATFORM_SUPER_ADMIN and prints its enrolment token.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.