Workload Scope Not Admissible

URI: https://docs.ankatech.co/errors/workload-scope-not-admissible
HTTP Status: 422 Unprocessable Content

When you see this

A request assigned an administrative workload one or more scopes a workload of that tenant may never hold. extensions.inadmissibleScopes names every one, in request order, and nothing was stored. See Administrative Workload Identity^*.

Common Causes

• A scope of the cryptographic data plane (secure.*, stream.*, interoperability.*, migration.*): key use belongs to cryptographic actors. The one exception is migration.importKeystore, which a tenant workload may hold and a platform workload never does.
• A quorum approve or policy-manage scope, a tenant identity-provider, account-recovery or support-access consent scope, tenant administrator appointment, a tenant notification-delivery write, a dangerous platform setting or a deployment-secret write.
• An Audit API scope other than the platform integrity pair (audit.platform.integrity.read, audit.platform.integrity.verify), which only a platform workload holds.
• A platform-exclusive scope, or a tenant workload management scope, for a workload that is not a platform workload.
• Any platform workload management scope (admin.platform.workload.*).
• A service-to-service or reserved scope.

Response Example

{
  "type": "https://docs.ankatech.co/errors/workload-scope-not-admissible",
  "title": "Workload Scope Not Admissible",
  "status": 422,
  "detail": "An administrative workload of this tenant cannot hold the following scope(s): admin.tenant.quorum.approve. A workload holds only scopes the catalog admits for workloads: no S2S, quorum decision, account-recovery, tenant identity-provider or tenant notification-delivery scope, and no audit scope but the platform integrity pair; of the cryptographic data plane only the keystore import, for a tenant workload only; platform scopes and tenant workload management only for a platform workload; and platform workload management never.",
  "instance": "/api/v3/admin/tenants/7d2f4a10-9c31-4b8e-a5d6-2f11c0b47e93/workloads/9b2f6c1e-3d4a-4c8b-a1e7-5f0d2c9b8a71/scopes",
  "timestamp": 1730000000,
  "extensions": {
    "inadmissibleScopes": [
      "admin.tenant.quorum.approve"
    ],
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

1. Remove the named scopes from the request.
2. Read GET …/workloads/assignable-scopes (listTenantWorkloadAssignableScopes or listPlatformWorkloadAssignableScopes): it lists exactly the scopes you may assign.
3. An operation a workload may never perform stays with a person.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.