Skip to content

Invalid Input

URI: https://docs.ankatech.co/errors/invalid-input
HTTP Status: 400 Bad Request

When you see this

You sent a syntactically valid HTTP request, but one or more required fields are missing, empty, malformed, or conflicting. The server cannot proceed until you correct your payload.

Common Causes

  • Missing mandatory JSON properties
    – A required field like kid, kty, alg, or newKey was blank or not present.

  • Conflicting parameters
    – Both header .kid and sourceKidOverride were provided, or neither was supplied.

  • Malformed Base64 payload
    – A field expected to be Base64 (e.g. publicKey, p12FileBase64) failed to decode.

  • Invalid JSON structure
    – Your request body wasn’t well-formed or was missing the expected object schema.

  • Unsupported key-type/operation combination
    – You tried to “re-sign” or “re-encrypt” with symmetric vs. asymmetric keys mismatched.

  • Malformed JWE/JWS header
    – A detached JWE/JWS was missing required header elements (e.g. protected, iv, tag, or kid).

Response Example

{
  "type": "https://docs.ankatech.co/errors/invalid-input",
  "title": "Invalid Input",
  "status": 400,
  "detail": "Field 'algorithm' is required and must be one of the catalog values.",
  "instance": "/api/v3/admin/tenants/2f1c9d84-6b2e-4d3a-9f57-0a1b2c3d4e5f/keys",
  "timestamp": 1751500800,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 7807 Problem Details.

The example above is an Admin API body, where the correlation identity is extensions.requestId; the Core API and the PQC Handshake API instead emit a top-level correlationId. Read the member your service emits — see Error Index & Overview.

detail is always a single human-readable sentence. It is never a nested JSON document, even when the rejection originated in an internal upstream service: see S2S Relay Envelope for how a relayed rejection is composed.

How to Resolve

  1. Inspect the response detail: it will pinpoint exactly which field or constraint failed.
  2. Supply all required fields: make sure kid, kty, alg, etc. are non-empty strings.
  3. Remove conflicting parameters: choose either header .kid or sourceKidOverride, not both.
  4. Validate Base64: ensure any Base64-encoded input (keys, JWE headers, PKCS#12) is correctly padded and valid.
  5. Check JWE/JWS structure: confirm your JSON Web Encryption/Signature includes all required fields (protected, iv, tag, kid).
  6. Use correct key types & operations: refer to the API reference for allowed combinations (encrypt, decrypt, sign, verify).
  7. Re-submit your request.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.