TSA Trust Anchor Not Retired

URI: https://docs.ankatech.co/errors/tsa-trust-anchor-not-retired
HTTP Status: 409 Conflict

When you see this

You asked to delete a trust anchor that is still ACTIVE. Deletion is deliberately a two-step operation: an anchor must be retired first, then deleted. Retirement is the step that removes it from the ACTIVE set projected to Redis and trusted by core-api, so it is what actually changes what the platform trusts. Nothing was deleted.

Common Causes

Delete was called directly on an ACTIVE anchor, skipping the retire step.
The console view is stale and shows an anchor as retired when the retirement never completed.
A retirement was rolled back — for example by the last-active-anchor guard — leaving the anchor ACTIVE.

Response Example

{
  "type": "https://docs.ankatech.co/errors/tsa-trust-anchor-not-retired",
  "title": "Conflict",
  "status": 409,
  "detail": "The trust anchor is not RETIRED and cannot be deleted. Retire it first.",
  "instance": "/api/v3/admin/platform/tsa/trust-anchors/7f1c2a90-3d44-4b21-9d0e-1c2f6b8a4e55",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

Retire the anchor first: POST /api/v3/admin/platform/tsa/trust-anchors/{id}/retire.
Confirm its status reads RETIRED in GET /api/v3/admin/platform/tsa/trust-anchors.
Delete it: DELETE /api/v3/admin/platform/tsa/trust-anchors/{id}.
If the retire itself was refused, resolve that refusal first — a last-active-anchor conflict means retiring this anchor would leave the deployment with no trusted TSA.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.