Token Signing Key Transition Refused

URI: https://docs.ankatech.co/errors/token-signing-key-transition-refused
HTTP Status: 500 Internal Server Error

When you see this

admin-api computed the key set that a rotation or revocation would produce and the key-set invariants refused it — for example a set without exactly one ACTIVE and one NEXT key. The server produced an unsound set, which is a defect of the server rather than a conflict the caller can resolve or a request the caller can correct. The refusal runs before anything is sealed: the stored set is unchanged and no audit event was written.

Common Causes

• A server defect in the transition that was requested. It is not transient.

Response Example

{
  "type": "https://docs.ankatech.co/errors/token-signing-key-transition-refused",
  "title": "Token Signing Key Transition Refused",
  "status": 500,
  "detail": "The token signing key transition would break a key-set invariant",
  "instance": "/api/v3/admin/platform/token-signing-keys/actions/rotate",
  "timestamp": 1798596000,
  "extensions": {
    "requestId": "6d1f3b9a-2e8c-4a57-b0d4-8c3e7f1a9b26"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The offending kids are logged by admin-api for diagnosis and never rendered.

How to Resolve

1. Do not retry: the same request produces the same set.
2. Report it with the requestId and admin-api's log line naming the offending keys. The published set keeps working in the meantime: nothing was changed.

See Admin API — Platform Token Signing Keys^*.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.