Skip to content

PQC Transport Not Available for Streaming

URI: https://docs.ankatech.co/errors/pqc-transport-not-available-for-streaming
HTTP Status: 400 Bad Request

When you see this

The request signalled PQC session transport on one of the eleven true-streaming multipart routes. The two are mutually exclusive by construction: PQC transport reads the whole body into memory and rewrites its content type to JSON, and a streaming multipart body survives neither step. The refusal is the first action of the PQC transport filter, so it happens before a single body byte is read.

Common Causes

  • The request carries X-PQC-Transport: true on a streaming route.
  • The request carries an X-PQC-Session header on a streaming route. Its presence alone triggers the refusal, whatever its value — including a blank one — so a caller who believes the exchange is PQC-protected is never left with an opaque failure.
  • A client sets the PQC headers globally for every call rather than only on the compact crypto plane.

The in-scope routes are the eight /api/v3/crypto/stream/* operations, /api/v3/migration/stream/analyze-pkcs7, /api/v3/interoperability/verify and /api/v3/interoperability/encrypt.

Response Example

{
  "type": "https://docs.ankatech.co/errors/pqc-transport-not-available-for-streaming",
  "title": "PQC Transport Not Available",
  "status": 400,
  "detail": "PQC session transport cannot be combined with a streaming multipart request. Resend this request without the X-PQC-Transport and X-PQC-Session headers; the connection is already protected by TLS.",
  "instance": "/api/v3/crypto/stream/encrypt",
  "correlationId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "timestamp": 1730000000,
  "extensions": {
    "code": "pqc.transport.streaming.unsupported"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Resend the request without X-PQC-Transport and without X-PQC-Session. The streaming routes are already protected by TLS.
  2. Scope the PQC transport headers to the compact crypto plane in your client, rather than applying them to every request.
  3. If a payload genuinely needs PQC session transport, use the compact (non-streaming) operation for it; the streaming surface cannot serve that combination on any route.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.