Skip to content

Rotation Interval Exceeds Its Ceiling

URI: https://docs.ankatech.co/errors/rotation-interval-exceeds-ceiling
HTTP Status: 422 Unprocessable Content

When you see this

A rotation-schedule write named an interval longer than a bound the platform enforces on every rotation cadence. Nothing was stored: the policy or the key's schedule is unchanged.

The request itself is well formed; the interval is valid on its own. It is refused because it is longer than one of these bounds, which extensions.ceiling names:

extensions.ceiling The bound Applies to
DEPLOYMENT_MAX The deployment maximum interval (maxInterval) The deployment default, a tenant default, a key's own interval
COMPLIANCE_CRYPTOPERIOD The maximum cryptoperiod the compliance packs the deployment licence entitles state for a key class (NIST SP 800-57 Part 1 Rev. 5 §5.3.6) — the strictest class for a deployment or tenant default, which keys of every class inherit; the key's own class for a key's interval The deployment default, a tenant default, a key's own interval
LOCKED_DEPLOYMENT_DEFAULT The default cadence of a compliance-locked deployment A tenant default, a key's own interval

Intervals are compared so that the result holds from any start date: a day count is compared with the shortest span the bound's months or years can have, so P1Y exceeds P365D.

Response Example

{
  "type": "https://docs.ankatech.co/errors/rotation-interval-exceeds-ceiling",
  "title": "Rotation Interval Exceeds Its Ceiling",
  "status": 422,
  "detail": "The interval P3Y is longer than the maximum cryptoperiod of 24 months for SYMMETRIC keys stated by the entitled compliance packs NIST_CSWP_39.",
  "instance": "/api/v3/admin/tenants/550e8400-e29b-41d4-a716-446655440000/keys/payments-data-key/rotation-schedule",
  "timestamp": 1790000000,
  "extensions": {
    "requestId": "5d9b3f71-6e2a-4c08-b4f7-0a8e2d6c1b95",
    "ceiling": "COMPLIANCE_CRYPTOPERIOD",
    "maximum": "P24M",
    "keyClass": "SYMMETRIC",
    "packIds": ["NIST_CSWP_39"]
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

Extension Meaning
ceiling The bound the interval exceeds
maximum That bound, as an ISO-8601 duration
keyClass For COMPLIANCE_CRYPTOPERIOD only: the key class whose maximum applies
packIds For COMPLIANCE_CRYPTOPERIOD only: the entitled compliance packs that state the maximum

How to Resolve

  1. Send an interval no longer than extensions.maximum. A shorter interval is always admitted.
  2. For DEPLOYMENT_MAX, a platform administrator may raise the deployment maxInterval, unless the deployment is compliance-locked.
  3. For COMPLIANCE_CRYPTOPERIOD and LOCKED_DEPLOYMENT_DEFAULT, the bound is regulatory and has no override: choose a shorter interval.

Operations that emit it

Method Endpoint
PUT /api/v3/admin/platform/deployment/policies/rotation-schedule
PUT /api/v3/admin/tenants/{tenantId}/policies/rotation-schedule
PUT /api/v3/admin/tenants/{tenantId}/keys/{kid}/rotation-schedule

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.