Skip to content

Tenant Recovery Request Required

URI: https://docs.ankatech.co/errors/tenant-recovery-request-required
HTTP Status: 409 Conflict

When you see this

A platform recovery authority asked to perform an assisted recovery (POST /api/v3/admin/platform/identity-recoveries, createIdentityRecovery) of an identity of a customer tenant, on a deployment ANKA operates (SAAS or DEDICATED_SAAS), without answering a pending request from one of the identity's tenants. Nothing was changed: no passkey, authenticator app, recovery code or password was invalidated, no session was ended and no enrolment token was minted.

An assisted recovery invalidates every credential of a person and hands over a token that lets its holder enrol a new one. On a deployment ANKA operates, the platform operator is not the customer, so the platform never takes that step on its own initiative: it acts only to answer a recovery request that one of the person's tenants filed (createUserRecoveryRequest), and only while that tenant still holds a membership of the person. The same rule is applied by Microsoft Entra and Okta, whose support does not reset a customer user's credentials.

The refusal is recorded in the audit trail as admin.identity-recovery.created with outcome DENIED, naming the request the call named, if any.

No request is needed for a platform identity, nor for any identity on a customer-operated deployment (PRIVATE_CLOUD, ON_PREMISE), where the operator is the customer.

Common Causes

  • The call carries no recoveryRequestId.
  • recoveryRequestId names a request the platform filed for itself, not one a tenant filed.
  • The named request was already answered: a recovery already performed it.
  • The tenant that filed the request no longer has the person as a member.

Response Example

{
  "type": "https://docs.ankatech.co/errors/tenant-recovery-request-required",
  "title": "Tenant Recovery Request Required",
  "status": 409,
  "detail": "An identity of a customer tenant is recovered only to answer a pending recovery request one of its tenants filed. Name that request in recoveryRequestId. Nothing was changed.",
  "instance": "/api/v3/admin/platform/identity-recoveries",
  "timestamp": 1760713512,
  "extensions": {
    "requestId": "0e9d8c7b-6a5f-4e3d-8c2b-1a0f9e8d7c6b"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Read the queue of recovery requests (GET /api/v3/admin/platform/identity-recovery-requests, listIdentityRecoveryRequests) and find the person's PENDING request.
  2. Perform the recovery again, naming that request in recoveryRequestId.
  3. When no tenant of the person has filed a request, ask the person to contact an administrator of their tenant, who files one (POST /api/v3/admin/tenants/{tenantId}/users/{userId}/recovery-requests).

See User Account Recovery*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.

* restricted content — see higher-tier documentation