Skip to content

Tier Bind Self-Test Failed

URI: https://docs.ankatech.co/errors/tier-bind-self-test-failed
HTTP Status: 422 Unprocessable Entity

When you see this

The bind verb wraps and unwraps an ephemeral, non-tenant key against the tier's own declared key-protection backend, and that round trip did not complete. Bind exists precisely to establish that the configuration an operator entered addresses a working backend, so the answer is 422 rather than 503: an unchanged configuration will not start working on its own. The tier was not bound and stays in DECLARED_PENDING_BIND, so binding again after correcting the configuration needs no other verb.

Common Causes

  • A coordinate in the tier's declared backend configuration is wrong — endpoint, region, key identifier, vault or token label.
  • The tier's credential is absent, or the backend rejects it.
  • A host-side provisioning step the tier's activation hint names has not been completed yet.
  • The declared backend is genuinely unreachable from this deployment.

Response Example

{
  "type": "https://docs.ankatech.co/errors/tier-bind-self-test-failed",
  "title": "Tier Bind Self-Test Failed",
  "status": 422,
  "detail": "This tier's key-protection backend did not complete a wrap/unwrap round trip with its current configuration. The tier was not bound and is unchanged.",
  "instance": "/api/v3/admin/platform/key-backend/tiers/ENTERPRISE/bind",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Re-read the tier's declared configuration and correct the coordinate that is wrong. The body names no vendor, endpoint, region or label by design — the underlying fault is in the server-side log, correlated by the request id.
  2. Complete the host-side provisioning step the tier's activation hint names, if one is outstanding.
  3. Bind again. The tier is still in DECLARED_PENDING_BIND, so no reset or re-declaration is required.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.