Skip to content

Review requests refused by a constraint policy

List the cryptographic operations your tenant refused because a constraint policy limit was exceeded, for a compliance or forensic review of how your constraint policies are enforced.

Who can do it

A tenant administrator or a tenant auditor, and a platform super administrator or platform auditor reading your tenant. The read needs the permission to read constraint violations, or the permission to read every tenant trail.

Before you start

  • There is no dedicated console control for this list; you call the audit API directly.
  • The list holds only the operations refused because a constraint of the grant refused the request: the usage limit was reached, the rate limit was reached or set to zero, a single-use grant was used a second time, the request fell outside a validity window (the constraint policy's, the use case's or the exchange's effective period), or the request fell outside the constraint policy's schedule. Other refusals that name the grant's constraint policy, such as a suspended exchange context or a constraint that could not be evaluated, are not listed.

Steps

  1. Request the list: GET /api/v3/audit/tenants/{tenantId}/constraint-violations (operation listConstraintViolations).
  2. Page through it with page (from 0) and size (50 by default, at most 100).

What you see when it worked

A page of cryptographic audit records, newest first, each with status DENIED and errorCode DENY_CONSTRAINT_VIOLATED. Each record carries when the refusal happened (eventTimestamp), the operation (operationType), the actor (actorId), the grant (grantId) and its constraint policy (constraintPolicyId, absent when the refusing constraint is the exchange's effective period of a grant without a policy), and the constraint that refused it in constraintEvaluations. The key is in keyId when the refused key was resolved; otherwise the key the request named is in requestedKeyId. A refusal records no algorithm.

On Audit Log, the Crypto tab filtered to the denied outcome lists these refusals among every other refused operation; an event's details show its error code.

If it fails

What you see Cause What to do
403 You lack the permission, or the path tenant is not your own Use an account of this tenant with an audit-reading role
401 No token, or an expired or revoked one Sign in again

Without the console

This task has no dedicated console control. There is no CLI command and no admin SDK method for it; the API in the steps above is the only surface.