Skip to content

Trust Anchors Are Platform-Plane Only

URI: https://docs.ankatech.co/errors/trust-anchor-platform-plane-only
HTTP Status: 403 Forbidden

When you see this

A tenant-plane request carried LDAPS trust-anchor configuration. Configuring a trust anchor decides which certificate authority admin-api will accept when it opens a TLS connection to a directory, which is a platform-operator decision — so the refusal is about the plane the request arrived on, not about the content of the submission. The request may be perfectly well-formed; it is still refused. Nothing is persisted and no connection is attempted.

Common Causes

  • Declaring a tenant-plane identity provider whose configuration includes trustAnchors.
  • Validating a candidate tenant-plane configuration that carries trustAnchors; the gate fires at configuration ingress, before any connectivity probe, so a tenant-plane caller cannot make admin-api complete a TLS handshake against a certificate authority of their choosing.
  • Running a connection test on a tenant-plane provider whose stored configuration holds trust anchors.

Response Example

{
  "type": "https://docs.ankatech.co/errors/trust-anchor-platform-plane-only",
  "title": "Trust Anchors Are Platform-Plane Only",
  "status": 403,
  "detail": "trustAnchors: LDAPS trust anchors are configurable on the platform plane only. The request was refused; nothing was persisted and no connection was attempted.",
  "instance": "/api/v3/admin/tenants/9c1b7f24-5a3e-4d68-8b0a-2f7d51c9e630/idp",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Remove trustAnchors from the tenant-plane request. Every other part of the identity-provider configuration remains available on the tenant plane.
  2. Configure the trust anchors on the platform plane instead, under /api/v3/admin/platform/idp.
  3. Do not expect a deployment type or a licensed edition to change this: the refusal is unconditional on the tenant plane, so an entitled tenant is refused exactly as an unentitled one is.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.