Skip to content

Rotation Policy Unresolvable

URI: https://docs.ankatech.co/errors/rotation-policy-unresolvable
HTTP Status: 503 Service Unavailable

When you see this

The stored rotation policy carries a mandatoryStandards token that resolves to no known cryptographic standard, so the policy cannot be evaluated as written. Resolution is fail-closed: the policy is refused outright rather than evaluated over the subset of tokens that happened to resolve, because silently dropping an entry would weaken the operator's policy with no observable signal. There is deliberately no Retry-After — the condition is durable until an operator repairs the stored policy, and retrying unchanged will not help.

Common Causes

  • A mandatoryStandards entry that is not a member of the platform's standards vocabulary — a typo, or a standard name that was never defined.
  • A policy row written by an external tool or a direct database edit rather than through the admin plane.
  • A token whose spelling differs from the vocabulary in more than surrounding whitespace (leading and trailing whitespace is trimmed before matching, so it alone never causes this).

Response Example

{
  "type": "https://docs.ankatech.co/errors/rotation-policy-unresolvable",
  "title": "Policy cannot be resolved",
  "status": 503,
  "detail": "The stored policy references a cryptographic standard that is not recognised, so it cannot be evaluated. This requires operator action; retrying will not succeed.",
  "instance": "/api/v3/keys/my-mlkem-key/rotate",
  "correlationId": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. This is an operator action, not a caller action. Do not retry the operation: the stored row is unchanged and will fail identically.
  2. Find the offending token in the core-api log. The response body deliberately carries none of it; the sanitised token and the correlation id are recorded server-side at the point where the stored row enters the policy resolver.
  3. Correct the rotation policy's mandatoryStandards so every entry names a standard the platform's vocabulary declares, then re-run the operation.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.