AB-9020 kms_unavailable
| Class | Internal |
| HTTP status | 503 |
| Retryable | yes |
When it happens
The gateway cannot unwrap the tenant's data key (own KMS or customer-managed key unreachable, or key disabled). Publishes and reads of encrypted payloads are refused; envelope metadata operations continue. details.key_provider, details.stage.
Hint
The tenant encryption key is unavailable ({reason}). Retry after {s}s. If you manage your own key, check that it is enabled and that AgentBus's role may unwrap with it.
Troubleshooting
- Customer-managed keys: check KMS key state and the grant for AgentBus's principal. 2. Our KMS: status page. 3. Reads of metadata (
trace,doctor) still work.