Skip to content

Platform Entry Unprovable

URI: https://docs.ankatech.co/errors/platform-entry-unprovable
HTTP Status: 400 Bad Request

The OAuth 2.0 error of this answer is invalid_grant (RFC 6749 §5.2). Only its error_uri and RFC 9457 type are its own, so a client that reads the error member treats it like any other refused grant, and a client that wants to explain it recognises it by its type.

When you see this

A platform administrator asked to enter a tenant on its behalf (the RFC 8693 token exchange at POST /api/v3/auth/token), and the administrator's identity holds nothing that can prove a recent entry: no user-verifying passkey, and the platform session was not opened through an approved identity provider. A password and an authenticator-app code never enter a tenant, so asking the administrator to sign in again would not help, and the exchange is refused at once instead of answering Reauthentication Required.

Nothing was issued, no support session was opened, and the target tenant was not examined: the answer is decided on the administrator's own session and authenticators, and says nothing about the tenant.

Common Causes

  • The administrator has not registered a passkey. A platform administrator who signs in with a password and an authenticator app can administer the platform, but cannot enter a tenant until a passkey is registered.
  • The administrator's passkey does not verify the user. Only a passkey that verifies the person (a PIN, a fingerprint or another local check) counts.

Response Example

{
  "error": "invalid_grant",
  "error_description": "Entering a tenant on its behalf requires a user-verifying passkey or an approved identity provider. Register a passkey, then try again.",
  "error_uri": "https://docs.ankatech.co/errors/platform-entry-unprovable",
  "type": "https://docs.ankatech.co/errors/platform-entry-unprovable",
  "title": "Platform Entry Unprovable",
  "status": 400,
  "detail": "Entering a tenant on its behalf requires a user-verifying passkey or an approved identity provider. Register a passkey, then try again.",
  "instance": "/api/v3/auth/token",
  "timestamp": 1737630000
}

Content-Type: application/json, the token endpoint's RFC 6749 shape, like every other answer of that endpoint.

How to Resolve

  1. In the console, open the account menu and choose Security.
  2. Add a passkey on a device that verifies you (a security key with a PIN, or a device with a fingerprint or face check).
  3. Enter the tenant again. The exchange then asks you to confirm with the passkey you added.

A deployment whose platform administrators sign in through an approved identity provider can enter tenants through that sign-in instead; the platform's authentication settings say whether one is approved.