Configure this deployment's key-protection backend

put

https://staging.ankatech.co/api/v3/admin/platform/setup/backend/configuration

Records the non-secret per-provider coordinates of the deployment key-protection
backend and returns the resulting activation state. Replaces the previous
configuration in place: the declaration is singular by database constraint, so a
second call updates the single row rather than creating a second one.

This is phase ONE of a two-phase surface, and it proves nothing.

The order is configure then credential then
activate. Configure opens no connection, validates no credential,

provisions no key and does not record which backend the deployment is running. Only
activate reaches the backend, and only activate writes the

declaration the platform serves. A configuration that has never been proved is
reported as such — activationState: CONFIGURED,
credentialPresent: false, and a self-test still reading
NOT_RUN / NEVER_INVOKED.

The request body is one shape for every backend: the declared backend token, the single keyId coordinate that names the

key on it, and — only when that backend accepts one — an endpoint. It
replaces three per-provider shapes that asked for four structured members on GCP and
two on Azure, while the per-tenant plane one rung down asked for the generic pair the
whole time. What an operator types into keyId, what to CALL that field,
and whether endpoint is asked for at all are published per backend on
GET /backend/declarable as coordinateContract; a client

renders that answer and holds no per-backend table of its own.

Unknown keys are still rejected: a projectId, a keyRing or an invented field is a 400 rather than a value silently

dropped. An endpoint submitted under a backend that accepts none is a
422 naming the endpoint requirement — it used to be a 400 on an

unknown key, because the GCP shape carried no endpoint member at all; the answer is
now the one the per-tenant plane has always given, from the single reader of the
declared requirement column. The token is carried inside the configuration object
itself, which is what keeps it in one place: a wrapper repeating it alongside would
be two homes for one value and a consistency check between them.

activationState is derived per request and is

stored in no table. It is composed from the declaration, the credential, the last
self-test verdict and the immutable binding, all read once.

Carries no credential and echoes none. ROOT-only (platform.bootstrap).

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

The coordinates, in the ONE shape every backend uses. The backend token sits INSIDE this object rather than wrapping a nested configuration member, and it is what selects the coordinate GRAMMAR keyId is parsed against and whether endpoint is accepted at all. Both answers are published per backend on GET /backend/declarable.

Non-secret coordinates for the deployment key-protection backend: the declared backend token, the one key coordinate that names the key on it, and — when the backend accepts one — the egress endpoint. The same pair for every backend. What an operator types into keyId, and whether endpoint is asked for at all, is published per backend on the declarable-backend read as coordinateContract. Unknown keys are REJECTED.

backend

string

enum

required

length between 0 and 64

Declared backend token, one of the nine declarable tokens: the four PKCS#11 vendors or the five Cloud KMS backends. The four PKCS#11 tokens were admitted here by console-first HSM activation, which made the console the way an HSM deployment declares, configures and activates its backend.

endpoint

string

length between 0 and 255

Egress endpoint for this backend, when it accepts one. An absolute https URL; inline credentials are rejected and a private range is accepted deliberately, because a VPC interface endpoint and a customer-operated vault are both legitimate targets. Its requiredness is PER BACKEND and is published on the declarable-backend read as coordinateContract.endpointRequirement — supplying one to a backend that does not accept it is REFUSED, not accepted and discarded.

keyId

string

length between 0 and 255

^[A-Za-z0-9:/._\-]+$

The one coordinate that names the key-encryption key on this backend: a key ARN on AWS, a Cloud KMS resource path on GCP, a vault key name on Azure. Its requiredness is PER BACKEND: a backend whose key name the platform derives asks for none, and supplying one to it is REFUSED rather than accepted and discarded. WHETHER one is asked for, what to call it, and what a well-formed one looks like are all published per backend on the declarable-backend read, as coordinateContract.keyIdRequirement, coordinateContract.keyIdLabelKey and coordinateContract.keyIdExample — read them rather than branching on the backend token, exactly as coordinateContract.endpointRequirement is read for the sibling field above.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

200The configuration was recorded; this is the resulting state.

400The sub-configuration is not a permitted shape: an unknown field, a field belonging to another provider family, a wrong type, a token outside the nine declarable tokens, or an endpoint that is not an absolute https URL. Nothing was written.

401Missing or invalid JWT.

403Caller is not the platform (ROOT) tenant.

409The key-protection backend is already bound and may hold wrapped key material; re-pointing its coordinates would orphan that material. Nothing was written and nothing was audited. It carries NO reason and NO selfTest member — nothing was contacted.