{"record":{"id":"07b1e2c890052004","repo":"apache/druid","slug":"cannot-create-table-definitions-in-schema-s","errorCode":null,"errorMessage":"Cannot create table definitions in schema: %s","messagePattern":"Cannot create table definitions in schema: (.+?)","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"extensions-core/druid-catalog/src/main/java/org/apache/druid/catalog/http/CatalogResource.java","lineNumber":588,"sourceCode":"  }\n\n  private static ResourceAction resourceAction(SchemaSpec schema, String tableName, Action action)\n  {\n    return new ResourceAction(new Resource(tableName, schema.securityResource()), action);\n  }\n\n  private void authorizeTable(\n      final SchemaSpec schema,\n      final String tableName,\n      final Set<Action> actions,\n      final HttpServletRequest request\n  ) throws CatalogException\n  {\n    if (Strings.isNullOrEmpty(tableName)) {\n      throw CatalogException.badRequest(\"Table name is required\");\n    }\n    if (actions.contains(Action.WRITE) && !schema.writable()) {\n      throw new ForbiddenException(\n          \"Cannot create table definitions in schema: \" + schema.name());\n    }\n    authorizeResource(new Resource(tableName, schema.securityResource()), actions, request);\n  }\n\n  private void authorizeResource(Resource resource, Set<Action> actions, HttpServletRequest request)\n  {\n    final AuthorizationResult authResult = AuthorizationUtils.authorizeAllResourceActions(\n        request,\n        actions.stream().map(action -> new ResourceAction(resource, action)).toList(),\n        authorizerMapper\n    );\n    if (!authResult.allowAccessWithNoRestriction()) {\n      throw new ForbiddenException(authResult.getErrorMessage());\n    }\n  }\n\n  private static Response okWithVersion(long version)","sourceCodeStart":570,"sourceCodeEnd":606,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-catalog/src/main/java/org/apache/druid/catalog/http/CatalogResource.java#L570-L606","documentation":"authorizeTable() in CatalogResource enforces that schema-level WRITE actions are only allowed on writable schemas. When a caller requests an action that includes Action.WRITE (create/edit/delete table) against a non-writable schema, it responds 403 Forbidden with this message before even checking per-table resource authorization.","triggerScenarios":"POST /druid-ext/v1/catalog/tables (or PUT/DELETE on a table) targeting a schema whose SchemaSpec.writable() is false, i.e. read-only schemas such as externally managed or system schemas.","commonSituations":"Trying to create tables in the read-only 'sys' or metadata schemas; users of scripts written for writable schemas re-pointed at a read-only schema; catalog configuration where the schema was declared non-writable by design.","solutions":["Switch the request to a writable schema (e.g. the 'druid' schema) where table definitions can be created.","Remove WRITE actions for that schema — use GET endpoints if you only intended to read.","If the schema should be writable, correct the catalog/schema configuration so SchemaSpec.writable() returns true, and ensure your role has WRITE permission."],"exampleFix":"// before\ncurl -X POST .../catalog/tables -d '{\"schema\":\"sys\",\"name\":\"t\",...}'\n\n// after\ncurl -X POST .../catalog/tables -d '{\"schema\":\"druid\",\"name\":\"t\",...}'","handlingStrategy":"validation","validationCode":"const schema = await fetch(`/druid-ext/v1/catalog/schemas/${schemaName}`).then(r => r.json());\nfunction canCreateTables(schema) {\n  return schema && schema.writable === true; // read-only schema check\n}","typeGuard":null,"tryCatchPattern":"const res = await fetch(url, {method: 'POST', body});\nif (res.status === 403) {\n  const msg = await res.text();\n  throw new Error(`Schema not writable or insufficient permissions: ${msg}`);\n}","preventionTips":["Check schema.writable() (via the schemas API) before issuing any table write.","Keep catalog CRUD scripts pointed at writable schemas like 'druid'.","Ensure the authenticated user/role has WRITE on the schema security resource, not just READ."],"tags":["catalog","authorization","http-403"],"backgroundTag":"permission-denied","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}