Skip to content

Projection Signing Key Custody Unavailable

URI: https://docs.ankatech.co/errors/projection-signing-key-custody-unavailable
HTTP Status: 503 Service Unavailable

When you see this

A platform administrator read, rotated or revoked the projection signing keys — the keys that sign the platform's authorization projections and settings messages — and the custody root that seals them refused the operation. Nothing was changed. The detail names the custody root by role only, never a backend, host or key.

Common Causes

  • The deployment key-protection backend (HSM or Cloud KMS) is unreachable or answering errors.
  • The deployment secret-custody layer could not be reached.

Response Example

HTTP/1.1 503 Service Unavailable
Content-Type: application/problem+json
Retry-After: <seconds>

{
  "type": "https://docs.ankatech.co/errors/projection-signing-key-custody-unavailable",
  "title": "Projection Signing Key Custody Unavailable",
  "status": 503,
  "detail": "The custody root of the projection signing keys is unavailable; retry shortly",
  "instance": "/api/v3/admin/platform/projection-signing-keys/actions/rotate",
  "timestamp": 1798596000,
  "extensions": {
    "requestId": "7c9e6679-7425-40de-944b-e07fc1f90ae7"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Retry after the Retry-After interval. The refused call changed nothing, so the retry is safe.
  2. If it persists, check the health of the deployment key-protection backend.

See Projection Signing Keys for the screen that lists, rotates and revokes these keys.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.