Skip to content

Next Projection Signing Key Not Yet Propagated

URI: https://docs.ankatech.co/errors/projection-signing-key-next-not-propagated
HTTP Status: 409 Conflict

When you see this

A platform administrator asked to rotate the projection signing keys before the NEXT key had been published long enough. A key signs only after every service has had time to hold it, so the rotation is refused and nothing is changed.

Common Causes

  • A rotation or a revocation published a fresh NEXT key a few minutes ago, and a second rotation was requested straight after it.
  • The platform was just installed: the first NEXT key is published together with the first ACTIVE key.

Response Example

HTTP/1.1 409 Conflict
Content-Type: application/problem+json
Retry-After: <seconds>

{
  "type": "https://docs.ankatech.co/errors/projection-signing-key-next-not-propagated",
  "title": "Next Projection Signing Key Not Yet Propagated",
  "status": 409,
  "detail": "The next projection signing key has not been published long enough to be promoted",
  "instance": "/api/v3/admin/platform/projection-signing-keys/actions/rotate",
  "timestamp": 1798596000,
  "extensions": {
    "requestId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
    "rotationAvailableAt": "2026-12-30T02:06:02Z"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Wait until extensions.rotationAvailableAt, or for the Retry-After interval, then rotate. The list of keys reports the same instant.
  2. To withdraw a compromised ACTIVE key immediately, revoke it instead: revoking the ACTIVE key is not bound by this wait.

See Projection Signing Keys for the screen that lists, rotates and revokes these keys.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.