Token Signing Key Not Published

URI: https://docs.ankatech.co/errors/token-signing-key-not-published
HTTP Status: 404 Not Found

When you see this

A platform administrator asked to revoke a user-token signing key (POST /api/v3/admin/platform/token-signing-keys/{kid}/actions/revoke) whose kid is not in the published key set. Nothing was changed and no audit event was written.

Common Causes

• The key was already revoked — by another administrator, or by an earlier attempt of the same request.
• The key was retired: a PREVIOUS key leaves the set at its retireAt, once every token it signed has expired.
• The kid was never a key of this deployment's set, for example one copied from another environment.

The three causes are deliberately one answer, so the refusal does not reveal which keys ever existed. The kid is not echoed.

Response Example

{
  "type": "https://docs.ankatech.co/errors/token-signing-key-not-published",
  "title": "Token Signing Key Not Published",
  "status": 404,
  "detail": "The token signing key is not in the published set",
  "instance": "/api/v3/admin/platform/token-signing-keys/Qm9gY3lz0bT9u5y2kM8wNqR4sLp7vXc2dF6hJ1kZa3E/actions/revoke",
  "timestamp": 1790820180,
  "extensions": {
    "requestId": "b1e6c4a9-3d2f-4f85-9c7a-6e0d2b8f4a13"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

1. Read the set again with GET /api/v3/admin/platform/token-signing-keys and check which keys are published now.
2. If the key you meant to withdraw is no longer listed, verifiers stop accepting it once they refresh the published set; there is nothing left to revoke.
3. If a different key must go, revoke that one, naming the state the list shows for it as expectedState.

See Admin API — Platform Token Signing Keys^*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.