SigNoz/signoz · error · errors.Error

CodeForbidden

CodeForbidden

Error message

oidc: email is not verified

What it means

Default branch in buildMetricQuery (SigNoz metrics v3 query_builder.go). The switch over mq.AggregateOperator exhausted all known cases for the requested (non-table) query shape and fell through, meaning the operator value is not one the time-series builder can compile to ClickHouse SQL.

Source

Thrown at ee/authn/callbackauthn/oidccallbackauthn/authn.go:134

	emailClaim, ok := claims[oidcConfig.ClaimMapping.Email].(string)
	if !ok {
		return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: missing email in claims")
	}

	email, err := valuer.NewEmail(emailClaim)
	if err != nil {
		return nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: failed to parse email").WithAdditional(err.Error())
	}

	if !oidcConfig.InsecureSkipEmailVerified {
		emailVerifiedClaim, ok := claims["email_verified"].(bool)
		if !ok {
			return nil, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "oidc: missing email_verified in claims")
		}

		if !emailVerifiedClaim {
			return nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, "oidc: email is not verified")
		}
	}

	name := ""
	if nameClaim := oidcConfig.ClaimMapping.Name; nameClaim != "" {
		if n, ok := claims[nameClaim].(string); ok {
			name = n
		}
	}

	var groups []string
	if groupsClaim := oidcConfig.ClaimMapping.Groups; groupsClaim != "" {
		if claimValue, exists := claims[groupsClaim]; exists {
			switch g := claimValue.(type) {
			case []any:
				for _, group := range g {
					if gs, ok := group.(string); ok {
						groups = append(groups, gs)

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Inspect mq.AggregateOperator at the call site and set it to a supported value for time-series queries (avg, sum, min, max, rate, *_rate, count, count_distinct, noop, etc.)
2. Ensure SigNoz frontend, query-service and schema (v3 package) are from the same release
3. If you maintain a fork, add the missing case to the switch in query_builder.go

Example fix

// before
qp.AggregateOperator = "" // zero value falls to default
query, err := v3.PrepareMetricQuery(...)

// after
qp.AggregateOperator = v3.AggregateOperatorAvg
query, err := v3.PrepareMetricQuery(...)

if qp.AggregateOperator == "" {
	qp.AggregateOperator = v3.AggregateOperatorAvg // sane default
}
// reject operators not in your supported set before building

null

query, err := v3.PrepareMetricQuery(...)
if err != nil && strings.Contains(err.Error(), "unsupported aggregate operator") {
	qp.AggregateOperator = v3.AggregateOperatorAvg
	query, err = v3.PrepareMetricQuery(...)
}

When it happens

Trigger: PrepareMetricQuery invoked with an AggregateOperator that is valid Go-side but has no case in this switch — e.g. an operator only implemented for table views, an empty operator string, or an operator from a newer/older SigNoz version.

Common situations: Mixing SigNoz component versions (old query-service, new UI sending new operators); constructing v3.QueryBuildPacket programmatically and forgetting to set AggregateOperator; renaming operators in a fork without updating all builders.

Related errors

• CodeLicenseUnavailable
• CodeInvalidInput
• CodeNotFound
• ErrCodeInvalidState
• CodeLicenseUnavailable

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/d529d925283b9a53. Report an issue: GitHub.