Skip to content

WebAuthn Metadata Refused

URI: https://docs.ankatech.co/errors/webauthn-metadata-refused
HTTP Status: 422 Unprocessable Content

When you see this

A platform operator uploaded a FIDO Metadata Service (MDS3) file (PUT /api/v3/admin/platform/webauthn-metadata, replaceWebauthnMetadata) and it was not admitted. The metadata already loaded stays in place, and the refusal is audited (admin.webauthn-metadata.updated, outcome DENIED, with the reason).

extensions.reason names the check that refused it:

reason Meaning
malformed The file is not an MDS3 metadata BLOB (a compact JWS carrying the serial number, nextUpdate and the entries)
signature-invalid The signature does not verify with the first certificate of its x5c chain
untrusted-chain The x5c chain does not lead to a FIDO Alliance metadata root this deployment bundles (GlobalSign Root R46, and GlobalSign Root CA - R3 until 2029-03-18), a certificate in it is not valid, or the signing certificate's subject common name is not exactly mds.fidoalliance.org (those roots also certify other subscribers)
expired The file's nextUpdate date has passed
older-than-stored The file's serial number is lower than the loaded file's

Common Causes

  • The file was downloaded from somewhere other than https://mds3.fidoalliance.org/, or altered in transit.
  • An old download was uploaded after the current one, or after its nextUpdate.

Response Example

{
  "type": "https://docs.ankatech.co/errors/webauthn-metadata-refused",
  "title": "WebAuthn Metadata Refused",
  "status": 422,
  "detail": "The metadata BLOB's nextUpdate date has passed; download the current BLOB. The stored metadata is unchanged.",
  "instance": "/api/v3/admin/platform/webauthn-metadata",
  "timestamp": 1730000000,
  "extensions": {
    "reason": "expired",
    "requestId": "c7d1e2f3-0a4b-4c5d-8e6f-7a8b9c0d1e2f"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Admin API body, so the correlation identifier is extensions.requestId; see Error Index & Overview.

How to Resolve

  1. Download the current file from https://mds3.fidoalliance.org/ on a connected workstation.
  2. Move it to the deployment unchanged, and upload it as application/jwt.
  3. With older-than-stored, nothing needs to be done: the loaded file is newer.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.