Skip to content

Workload Identity Federation Is Not Included In This Edition

URI: https://docs.ankatech.co/errors/workload-identity-not-entitled
HTTP Status: 403 Forbidden

When you see this

Declaring your own trusted issuers for workload identity is not included in this tenant's licensed edition, or the tenant's effective edition could not be confirmed at the moment of the request.

Both outcomes answer with this same status and type deliberately. A licence lookup that fails is not an internal fault and is not reported as one; the resolution extension member is what distinguishes the two.

Common Causes

  • The tenant's effective edition is below the edition this capability requires.
  • The licence could not be read for this tenant, so the fail-closed floor edition was assumed. resolution is FLOORED in this case.

Response Example

{
  "type": "https://docs.ankatech.co/errors/workload-identity-not-entitled",
  "title": "Workload Identity Federation Is Not Included In This Edition",
  "status": 403,
  "detail": "Declaring your own trusted issuers for workload identity requires edition ENTERPRISE; this tenant's effective edition is BUSINESS. Workloads that already authenticate through a declared issuer are unaffected. Contact your account manager to enable it for this tenant.",
  "instance": "/api/v3/admin/tenants/3f9a1b62-5d47-4c8e-b0a2-91d7e4f60cc5/workload-identity/issuers",
  "timestamp": 1730000000,
  "extensions": {
    "requiredEdition": "ENTERPRISE",
    "effectiveEdition": "BUSINESS",
    "resolution": "LICENSED",
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Read resolution first. LICENSED means the edition is confirmed and genuinely does not include the capability; FLOORED means the licence could not be confirmed and the floor was assumed.
  2. On LICENSED, compare effectiveEdition against requiredEdition and contact your account manager to raise the tenant's edition.
  3. On FLOORED, retry shortly — the verdict is transient. Contact support if it persists.
  4. Workloads that already authenticate through a previously declared issuer keep working throughout; this refusal only blocks new declarations.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.