Skip to content

TSA Trust Anchor Not Active

URI: https://docs.ankatech.co/errors/tsa-trust-anchor-not-active
HTTP Status: 409 Conflict

When you see this

You asked to retire a trust anchor that is not in the ACTIVE state. Retirement is the ACTIVE to RETIRED transition, so an anchor that is already RETIRED has nothing left to retire. The anchor exists — a missing id answers with 404 tsa-trust-anchor-not-found instead — and it is left untouched.

Common Causes

  • The anchor was already retired, by an earlier request or by another operator.
  • The console view predates a retirement performed elsewhere and still offers the retire action.
  • A retire was retried after a response was lost in transit; the first attempt had already succeeded.

Response Example

{
  "type": "https://docs.ankatech.co/errors/tsa-trust-anchor-not-active",
  "title": "Conflict",
  "status": 409,
  "detail": "The trust anchor is not ACTIVE and cannot be retired.",
  "instance": "/api/v3/admin/platform/tsa/trust-anchors/7f1c2a90-3d44-4b21-9d0e-1c2f6b8a4e55/retire",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read the anchor's current status from GET /api/v3/admin/platform/tsa/trust-anchors.
  2. If it already reads RETIRED, the outcome you wanted is already in place — no retry is needed.
  3. If you meant to remove the row entirely, follow the retirement with DELETE /api/v3/admin/platform/tsa/trust-anchors/{id}, which is allowed on a RETIRED anchor.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.