Skip to content

Secret Custody Unavailable

URI: https://docs.ankatech.co/errors/secret-custody-unavailable
HTTP Status: 503 Service Unavailable

When you see this

A per-tenant secret-custody operation could not reach or provision that tenant's own secret-custody key-encryption key. This is the tenant plane of secret custody; the deployment tier answers backend-not-bound for the equivalent condition. The refusal is fail-closed and carries a Retry-After header: there is deliberately no degradation onto the deployment KEK, so a tenant secret that cannot be sealed under the tenant's own key is not sealed at all and the calling transaction rolls back with no dangling credential reference.

Common Causes

  • The environment's key-protection backend is not bound, so no tenant secret-custody KEK can be resolved or created.
  • The tenant secret-custody KEK could not be provisioned on the backend, or the generated key did not persist.
  • The backend was transiently unreachable while a tenant secret was being sealed or unsealed — for example while resolving an alert destination, an event-forwarding destination, an identity-provider secret, a tenant observability backend, or a tenant BYOK credential.

Response Example

{
  "type": "https://docs.ankatech.co/errors/secret-custody-unavailable",
  "title": "Secret custody unavailable",
  "status": 503,
  "detail": "Secret custody is temporarily unavailable. Retry the operation shortly.",
  "instance": "/api/v3/admin/s2s/event-forwarding/secrets/resolve",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "e4d17b93-05ca-4f28-b761-8309a6c2e14f"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Check the environment's key-protection state with GET /api/v3/admin/platform/setup/status and finish first-run provisioning if the backend is not bound.
  2. Confirm the key-protection backend is reachable from admin-api; the underlying cause is written to the server logs and is never rendered in the response.
  3. Retry after the interval in the Retry-After header. Nothing was persisted, so no partial envelope or orphaned credential reference was left behind.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.