Cloud token mint failure

cross-project search machine learning datafeeds mint an internal cloud API key when you create or update a datafeed (PUT _ml/datafeeds/{id} or POST _ml/datafeeds/{id}/_update). Mint failures happen at that moment — during the synchronous validate-before-mint step — not during periodic datafeed runs.

If the datafeed was created successfully but later searches fail authorization, see Cloud token runtime failure instead.

When it happens

Mint failure occurs only on create or update. A running datafeeds that already has credentials does not hit this path during extraction cycles.

Error messages

The API returns a synchronous error on PUT or POST _ml/datafeeds/{id}/_update. Cluster logs include:

Failed to mint internal cloud API key for CPS datafeed
		

The log line includes the datafeeds id. The API error body carries the underlying cause (for example, the owning user no longer exists or validate-before-mint search probe failed).

Check job status in Kibana

When mint fails, the anomaly detection jobs list may show an API key error indicator on the affected job. For cloud API key prerequisites, refer to Elastic Cloud API keys.

Confirm this is not a runtime failure

Re-establish ownership under a valid user

Mint uses the user principal stored on the job. If that account was deleted or cannot receive a grant:

1. Sign in to Kibana as a currently valid user with rights to manage the job.
2. Update the datafeeds (or recreate the job) so credential mint runs under your account:

				POST _ml/datafeeds/{datafeed_id}/_update
					{
  "indices": ["<unchanged>"],
  "project_routing": "<unchanged or intended value>"
}
		

3. Confirm the API key error indicator clears in the anomaly detection jobs list.

What does not fix mint failure

Rotating your personal API key alone does not re-mint the job's internal cloud key. You must update or recreate the datafeeds while authenticated as a valid cloud user.

Fix validate-before-mint probe errors

If the error references search authorization or a missing project reference, fix project_routing, index qualifiers, or project links first, then retry the update. See Linked project skipped and Stale project reference.

If mint still fails after these steps, contact Elastic support with the datafeeds id and the full API error response.