Token Signing Key Custody Unavailable

URI: https://docs.ankatech.co/errors/token-signing-key-custody-unavailable
HTTP Status: 503 Service Unavailable

When you see this

The custody root that seals the user-token signing key set refused a seal or an unseal, so admin-api could not read or change the set. Nothing was written. The detail names the custody root by role only — never a backend, host, KEK label or envelope.

Common Causes

• The deployment key-protection backend (HSM or Cloud KMS) is unreachable or answering errors.
• The deployment secret-custody layer could not be reached.

Response Example

HTTP/1.1 503 Service Unavailable
Content-Type: application/problem+json
Retry-After: 30

{
  "type": "https://docs.ankatech.co/errors/token-signing-key-custody-unavailable",
  "title": "Token Signing Key Custody Unavailable",
  "status": 503,
  "detail": "The custody root of the token signing keys is unavailable; retry shortly",
  "instance": "/api/v3/admin/platform/token-signing-keys/actions/rotate",
  "timestamp": 1798596000,
  "extensions": {
    "requestId": "9f3b6e2a-4c8d-4d17-a5e0-7b2c9d1f6a38"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

1. Retry after Retry-After. The refused call changed nothing, so the retry is safe.
2. If it persists, check the health of the deployment key-protection backend; admin-api logs the failure by type.

See Admin API — Platform Token Signing Keys^*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.