Skip to content

Key-Material Backend State Unverifiable

URI: https://docs.ankatech.co/errors/tenant-backend-immutability-unverifiable
HTTP Status: 503 Service Unavailable

When you see this

A change to a tenant's key-material backend could not proceed because the platform could not verify whether that tenant already holds key material. The authority for that decision is a service-to-service read against core-api; when it errors, times out, returns a non-2xx status or a malformed body, the result is treated as unknown and the change is denied. The decision is fail-closed by design, so a transient outage can never open a window that admits a backend change on a tenant that may already hold material. The response carries a Retry-After header.

Common Causes

  • core-api is unreachable from admin-api, or the request timed out.
  • The key-material-exists probe returned a non-2xx status.
  • The probe returned a body the platform could not parse.

Response Example

{
  "type": "https://docs.ankatech.co/errors/tenant-backend-immutability-unverifiable",
  "title": "Key-Material Backend State Unverifiable",
  "status": 503,
  "detail": "The key-material backend state could not be verified; retry the operation shortly.",
  "instance": "/api/v3/admin/platform/tenants/7d1c9b40-52e8-4a36-9f07-c3b81e6d240a/key-backend/byok",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "3d4790ec-58b1-42a7-9c60-eb1782f5a30d"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Confirm core-api is healthy and reachable from admin-api; the transport cause is written to the server logs and is never rendered in the response.
  2. Retry after the interval in the Retry-After header — the condition is transient and the same request can succeed once the probe answers.
  3. Do not read this as a statement about the tenant. Nothing was decided about whether it holds key material; the platform declined to guess.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.