SigNoz/signoz · error

root_user_operation_unsupported

root_user_operation_unsupported

Error message

this operation is not supported for the root user

What it means

Returned by User.ErrIfRoot() when the target user has IsRoot==true. The root (system) user is a special built-in account whose attributes cannot be modified, deleted, or used for auth flows like password reset. Callers are expected to enrich the error with errors.WithAdditionalf to describe the specific operation.

Source

Thrown at pkg/types/user.go:158

}

// PromoteToRoot promotes the user to a root user with admin role.
func (u *User) PromoteToRoot() {
	u.IsRoot = true
	u.UpdatedAt = time.Now()
}

// UpdateEmail updates the email of the user.
func (u *User) UpdateEmail(email valuer.Email) {
	u.Email = email
	u.UpdatedAt = time.Now()
}

// ErrIfRoot returns an error if the user is a root user. The caller should
// enrich the error with the specific operation using errors.WithAdditionalf.
func (u *User) ErrIfRoot() error {
	if u.IsRoot {
		return errors.New(errors.TypeUnsupported, ErrCodeRootUserOperationUnsupported, "this operation is not supported for the root user")
	}
	return nil
}

// ErrIfDeleted returns an error if the user is in deleted state.
// This error can be enriched with specific operation by the called using errors.WithAdditionalf.
func (u *User) ErrIfDeleted() error {
	if u.Status == UserStatusDeleted {
		return errors.New(errors.TypeUnsupported, ErrCodeUserStatusDeleted, "unsupported operation for deleted user")
	}
	return nil
}

// ErrIfPending returns an error if the user is in pending invite state.
// This error can be enriched with specific operation by the called using errors.WithAdditionalf.
func (u *User) ErrIfPending() error {
	if u.Status == UserStatusPendingInvite {
		return errors.New(errors.TypeUnsupported, ErrCodeUserStatusPendingInvite, "unsupported operation for pending user")

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Exclude the root user from any update/delete/password-reset flows (check user.IsRoot before calling)
2. Use a regular admin account instead of the root user for day-to-day operations
3. If hit during login, verify the login email is not the configured root user email

Example fix

// before
if err := user.ErrIfRoot(); err != nil { ... }

// after
if user.IsRoot {
    return errors.New(errors.TypeUnsupported, errors.CodeUnsupported, "cannot modify the root user")
}
if err := user.ErrIfRoot(); err != nil { ... }

if user.IsRoot {
    return errors.New(errors.TypeUnsupported, "operation", "cannot operate on root user")
}

func isRootUser(u *types.User) bool { return u != nil && u.IsRoot }

When it happens

Trigger: Calling CreateCallbackAuthNSession, UpdateUser, DeleteUser, GetOrCreateResetPasswordToken, ForgotPassword, or UpdatePasswordByResetPasswordToken with the root user (typically identified by the fixed root user UUID/email configured at startup).

Common situations: Scripts or seed data that iterate over all users including the root account; API clients that hardcode an admin email which is configured as the SigNoz root user; attempting SSO callback login as root.

Related errors

• CodeLicenseUnavailable
• CodeInvalidInput
• CodeForbidden
• CodeNotFound
• ErrCodeInvalidState

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/804c052feefe1d3d. Report an issue: GitHub.