↑↓ select ↵ open ⌫ change scope Open full search

PG.CENTER connects PostgreSQL documentation, reference, and ecosystem knowledge. Maintained by Pigsty.

SQLSTATE / CLASS 2F · SQL ROUTINE EXCEPTION

2F003

Read PG 18 manual ↗

prohibited_sql_statement_attempted

SQLSTATE
2F003
Condition name
prohibited_sql_statement_attempted
Class
SQL Routine Exception
Source macro
ERRCODE_S_R_E_PROHIBITED_SQL_STATEMENT_ATTEMPTED
Evidence
Source path confirmed
Analysis & operational context

English SQLSTATE atlas: authored explanations and source/runtime evidence are separate from the manual definitions. View source ↗

<h1>2F003</h1>

At a glance

The fixed scan confirms this ERROR in both dblink and postgres_fdw connection paths. dblink also reports it when a command would return rows where the dblink API expects no result. The authentication variants are wrapper/connection policy paths, not proof that every prohibited SQL statement uses this code.

Meaning

The confirmed messages include statement returning results not allowed, and authentication variants such as password or GSSAPI delegated credentials required with a detail and sometimes a hint. postgres_fdw adds detail about the user mapping and may hint at password_required=false; dblink has its own credential wording. Keep the producer because the same SQLSTATE covers separate APIs.

Messages

Confirmed messages include statement returning results not allowed, plus password or GSSAPI delegated credentials required, which carries detail and may also carry a hint depending on the path. postgres_fdw identifies the user mapping in its detail and one path mentions password_required=false in the hint; dblink uses its own credential wording. Because the same SQLSTATE covers separate APIs, retain the actual producer.

Diagnosis

For dblink, identify whether the local call is a row-returning command used through a no-result API or a connection credential check. For postgres_fdw, inspect the foreign-server connection, user mapping, authentication method, and the server’s password_required policy when the message names them. Preserve the fixed detail/hint and do not collapse dblink and postgres_fdw into one generic wrapper.

Response

Correct the command/API pairing or the named connection credentials and user mapping, then verify the remote operation. A remote connection attempt may not have completed; preserve the remote/local boundary before retrying. Do not change transaction policy merely because dblink or postgres_fdw reported 2F003.

Versions

The locked catalogue places this condition at least by PostgreSQL 7.4. The facts block lists the published snapshots; source-path status is limited to the fixed PostgreSQL 18.6 evidence below.

Sources

Read the fixed dblink.c and postgres_fdw connection.c paths alongside the structured evidence record.

Source evidence

Evidence belongs to the frozen source and runtime versions listed here. It is not a runtime verification of the selected manual version.

2F003 is prohibited_sql_statement_attempted in SQLSTATE Class 2F.

Method: Read the fixed errcodes definition row, severity, and macro.

src.errcodes.18.6

The fixed PostgreSQL 18.6 source contains the report contexts and message variants described on the page.

Method: Read the complete source context around the resolved report groups.

Limits: Source confirmation is not a runtime observation in this batch.

src.path.0 src.path.1

Locked release definitions establish catalogue presence from 7.4; they do not establish a precise introducing release or runtime use.

Method: Compare canonical release facts with the available history boundary.

Limits: Definition presence is not an emitting-path observation.

src.errcodes.18.6

Message templates

ERROR · message.dblink-results-not-allowed

Primary

statement returning results not allowed

This is dblink no-result API enforcement.

ERROR · message.dblink-credentials-with-hint

Primary

password or GSSAPI delegated credentials required

Detail

Non-superusers may only connect using credentials they provide, eg: password in connection string or delegated GSSAPI credentials

Hint

Ensure provided credentials match target server's authentication method.

Credential wording and whether HINT is present vary by dblink connection path.

ERROR · message.dblink-credentials-no-hint

Primary

password or GSSAPI delegated credentials required

Detail

Non-superusers must provide a password in the connection string or send delegated GSSAPI credentials.

This dblink credential branch has DETAIL but no HINT.

ERROR · message.postgres-fdw-password-required

Primary

password or GSSAPI delegated credentials required

Detail

Non-superuser cannot connect if the server does not request a password or use GSSAPI with delegated credentials.

Hint

Target server's authentication method must be changed or password_required=false set in the user mapping attributes.

User mapping, authentication method, and password_required setting are deployment-dependent.

ERROR · message.postgres-fdw-scram-pass-through

Primary

password or GSSAPI delegated credentials required

Detail

Non-superusers must delegate GSSAPI credentials, provide a password, or enable SCRAM pass-through in user mapping.

This branch has DETAIL and no HINT.

Reproduction & repair cases

No reproduction case is attached to this condition.

Recorded runtime evidence

No runtime observation is attached to this entry.

Definition snapshot: english-manuals:2ba78b2fd9a22d0f525e9ed28e4… · English manual source