Skip to content

Trusted Issuer Still Has Bindings

URI: https://docs.ankatech.co/errors/trusted-issuer-in-use
HTTP Status: 409 Conflict

When you see this

The withdrawal was refused because actor bindings still depend on this issuer. Withdrawing it would leave those workloads unable to authenticate, so the bindings are removed explicitly first rather than silently along with the issuer.

The bindingCount extension member says how many. It counts the tenant's own bindings — the dependency read is tenant-scoped like every other read on this surface — so it discloses nothing about anyone else.

Common Causes

  • Withdrawing a trusted issuer that still has one or more actor bindings.
  • Cleaning up a declaration without first removing the bindings that resolve through it.
  • Intending to stop trusting the issuer temporarily, where disabling is the operation you want rather than withdrawal.

Response Example

{
  "type": "https://docs.ankatech.co/errors/trusted-issuer-in-use",
  "title": "Trusted Issuer Still Has Bindings",
  "status": 409,
  "detail": "This issuer still has 3 actor bindings. Withdrawing it would leave those workloads unable to authenticate, so the bindings are removed explicitly first rather than silently with the issuer. Disabling the issuer instead stops it being trusted on the very next request and keeps the bindings.",
  "instance": "/api/v3/admin/tenants/3f9a1b62-5d47-4c8e-b0a2-91d7e4f60cc5/workload-identity/issuers/9e2f77a1-3c04-42db-8f5b-1a6d0e93bb41",
  "timestamp": 1730000000,
  "extensions": {
    "bindingCount": 3,
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. If you want to stop trusting the issuer now and keep the bindings: disable the declaration instead of withdrawing it. It stops being trusted on the very next request.
  2. If you genuinely want it gone: list the actor bindings that resolve through this issuer, remove them explicitly, then re-issue the withdrawal.
  3. Use bindingCount to size the work before starting.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.