Declares (or re-declares) this deployment's key-protection backend for first-run provisioning. The body carries only the backend slug — never a PIN and never a credential. Changeable until the backend is bound; once it is, the declaration is refused 409 before any mutation and before any audit.

On some backends this is the LAST step that asks the operator for anything. Where the declared token asks for no egress endpoint, asks for no key coordinate, and belongs to a family that seals no deployment credential, this operation ALSO commits the deployment key-backend descriptor and publishes its projection — in the same transaction that records the declaration, so no window exists in which the declaration stands and the descriptor does not. The next call is then POST /backend/activate directly. PUT /backend/configuration is the step where an operator supplies coordinates, and such a token has none to supply; waiting for it is how a deployment came to hold a declared backend and no descriptor at all, with the activation refusing and nothing saying why.

The three conditions hold together, and the first one alone is not the rule. SIX of the nine declarable tokens ask for no endpoint — two of them, gcp-kms and gcp-kms-hsm, still require a key coordinate and still seal a credential, so they are recorded and nothing further happens. The conjunction is satisfied today by the four PKCS#11 vendors (softhsm, nshield, luna, cloudhsm), and it names no vendor: any future backend of the same shape inherits it with no change to this operation. The per-token answers are published on GET /backend/declarable.

A second declaration REPLACES a standing derived descriptor. The superseded row is removed and its projection eviction announced BEFORE the new row is derived, so no consumer keeps serving a protector built from the descriptor that was replaced. Re-declaring is the corrective action for a wrong vendor pick. One exception: a standing descriptor whose family seals a deployment credential is left byte-identical — deleting it would put a destructive custody action behind a non-destructive verb — and the route between two such declarations is DELETE /backend/declare, which disposes of the envelope on its way out.

A mechanism this deployment does not OFFER is refused 422. A mechanism whose certification level is EXPERIMENTAL is declarable only while the platform setting ankasecure.key-protection.experimental.offered-backends names it; a CERTIFIED one is always offered and that setting cannot withdraw it. The refusal names the mechanism, its level and the setting to change, because the only caller who can reach this operation is the only person who can change it. GET /backend/declarable publishes the same verdict per token, so a console never has to discover it by submitting.

ROOT-only (platform.bootstrap).