Skip to content

Key Protection Backend Unavailable

URI: https://docs.ankatech.co/errors/key-protection-backend-unavailable HTTP Status: 503 Service Unavailable

When you see this

The backend that protects key material is configured and bound, but was momentarily unreachable when your request needed it. The operation was refused before anything was written — no key material was persisted and no partial state was left behind.

Unlike its two siblings, this condition is expected to clear by itself, so the response carries a Retry-After header.

Common Causes

  • A transient network fault between the service and the backend.
  • The backend was restarting, failing over, or briefly saturated.
  • A session with the backend was lost and could not be re-established for this request.

How to Resolve

  1. Retry after the interval given in the Retry-After header, with exponential backoff.
  2. If retries keep failing well past that interval, the condition is not transient — check whether the backend is reachable from the deployment, and treat it as Key Protection Backend Misconfigured instead.
  3. Quote the correlationId from the response body when reporting it; the diagnosable detail is recorded server-side, never in the response.

Why the body says so little: every key-protection refusal renders the same fixed, backend-agnostic text on purpose. Naming the backend, its vendor, its module path or the underlying error code would disclose the deployment's internal topology to any caller. The distinguishing detail is in the deployment's own logs, keyed by correlationId.