Skip to content

Rotation Outcome Unknown

URI: https://docs.ankatech.co/errors/rotation-outcome-unknown
HTTP Status: 504 Gateway Timeout

When you see this

The Admin API sent your key rotation to the platform's key service and no answer arrived: the rotation deadline passed, the connection was lost after the request left, or the answer could not be read. The rotation may have been applied. It is not a failure, and the platform never records it as one: the administrative audit record states that the outcome is unknown and names the rotation.

Returned by POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/rotations (rotateKey). The response names the rotation in extensions.executionId.

A rotation the key service refused, or one it never received (it answered with a server error, or the call was refused before it was sent), is not this type: those answer with the refusal, or with 502 Upstream Service Unavailable, and nothing was rotated.

Response Example

{
  "type": "https://docs.ankatech.co/errors/rotation-outcome-unknown",
  "title": "Rotation Outcome Unknown",
  "status": 504,
  "detail": "The rotation was sent to the key service and no answer arrived, so it may have been applied. Retry with the same Idempotency-Key to obtain its outcome; a new request may rotate the key again.",
  "instance": "/api/v3/admin/tenants/6f1b2c4e-8a3d-4f7e-9c21-5b0d7e9a1f34/keys/payments-signing-key/rotations",
  "extensions": {
    "requestId": "8b3f0c27-4e1d-4a9b-b6c5-3e7a1d9f2c04",
    "executionId": "0b9a6f0e-4c1d-4f7a-9a51-2f4b9c3d8e21"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Resend the same request with the same Idempotency-Key. The resend is the same rotation, so it never rotates twice: if the rotation was applied, the answer is 200 with the applied rotation and the header Idempotent-Replayed: true; if it was not, it is applied once.
  2. If the original request carried no Idempotency-Key, it cannot be resent safely: a new request is a new rotation and may rotate the key again. Read the key first (GET /api/v3/admin/tenants/{tenantId}/keys/{kid}) and compare its material version with the one you rotated from.
  3. A resend may be answered 409 Material Version Moved when the rotation was never applied and another rotation advanced the key meanwhile. Read the key and decide whether a new rotation, under a new Idempotency-Key, is still wanted.

A compliance remediation step that receives this answer records the key as UNKNOWN, never FAILED; a later execution of the action re-evaluates the key.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.