Skip to content

Platform Super Administrator Role Immutable

URI: https://docs.ankatech.co/errors/platform-super-admin-role-immutable
HTTP Status: 409 Conflict

When you see this

The request edits or deletes the built-in PLATFORM_SUPER_ADMIN role. Its scopes are the platform catalogue's, and no request changes them: narrowing or emptying the role would demote every holder at once, the caller included. An edit is refused even when it submits exactly the scopes the role already holds.

Common Causes

  • Saving PLATFORM_SUPER_ADMIN on the platform's built-in role editor (updateRoleScopes).
  • Editing (updateRole) or deleting (deleteRole) a role named PLATFORM_SUPER_ADMIN through a tenant's role operations.

Response Example

{
  "type": "https://docs.ankatech.co/errors/platform-super-admin-role-immutable",
  "title": "Platform Super Administrator Role Immutable",
  "status": 409,
  "detail": "PLATFORM_SUPER_ADMIN cannot be edited or deleted: its scopes are the platform catalogue's. Nothing was changed.",
  "instance": "/api/v3/admin/platform/roles/PLATFORM_SUPER_ADMIN"
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. The detail is fixed.

Nothing is changed, and the refusal is recorded in the administrative audit trail of the tenant the request addressed (the platform tenant for the built-in role editor) as a DENIED change of the role, with the reason platform-super-admin-role-immutable.

How to Resolve

  1. Leave PLATFORM_SUPER_ADMIN as it is. To give a platform administrator fewer permissions, assign them another platform role (PLATFORM_OPERATOR, PLATFORM_AUDITOR or PLATFORM_VIEWER) instead.
  2. To change what the other built-in roles grant, edit those roles; they are not affected by this refusal.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.