Skip to content

Workload Self-Modification Forbidden

URI: https://docs.ankatech.co/errors/workload-self-modification-forbidden
HTTP Status: 403 Forbidden

When you see this

An administrative workload addressed itself in a write operation: its status, name, keys, federation bindings or scopes. A workload never changes itself, so it can neither widen its own scopes nor keep a credential alive that its administrators revoked. Nothing changed.

Common Causes

  • A workload tried to replace its own scopes.
  • A workload tried to register, rotate or revoke its own key, or bind or unbind its own subject.
  • A workload tried to suspend, reactivate, revoke or rename itself.

Response Example

{
  "type": "https://docs.ankatech.co/errors/workload-self-modification-forbidden",
  "title": "Workload Self-Modification Forbidden",
  "status": 403,
  "detail": "An administrative workload cannot change its own status, credentials, federation bindings or scopes. A person, or another workload that covers its scopes, performs the change.",
  "instance": "/api/v3/admin/tenants/7d2f4a10-9c31-4b8e-a5d6-2f11c0b47e93/workloads/9b2f6c1e-3d4a-4c8b-a1e7-5f0d2c9b8a71/scopes",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Have a person with the operation's scope make the change.
  2. Or, across planes, have a platform workload that holds every scope of the target, and more, make it where the deployment model allows.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.