Skip to content

Key Protection Backend Not Configured

URI: https://docs.ankatech.co/errors/key-protection-backend-not-configured HTTP Status: 409 Conflict

When you see this

The deployment has not finished binding the backend that protects key material, so no key can be created, imported, rotated or used. The operation was refused before anything was written — no key material was persisted and no partial state was left behind.

This is a state of the deployment, not of your request. Retrying an identical request will produce an identical response until an operator completes the setup, which is why no Retry-After header is sent.

Common Causes

  • The environment was created but the key-protection backend has not been activated yet.
  • The declared backend was never bound, so no key-encryption key exists for it to use.
  • A tenant was assigned to a backend tier the deployment does not offer.

How to Resolve

  1. Do not retry on a timer. This condition does not clear on its own.
  2. If you administer the deployment, complete the setup for the declared backend and retry afterwards.
  3. If you do not, report the error to whoever operates the deployment — the response body carries a correlationId that lets them find the corresponding server-side entry.

For API clients: this response carries the extension member setupState with the value KEY_BACKEND_UNCONFIGURED. A console or SDK can read it to route an operator into the setup flow rather than showing a generic conflict. It appears on this type only — the sibling Key Protection Backend Misconfigured deliberately omits it, because there the backend is configured and a setup wizard would have nothing to do.