{"record":{"id":"28917149406e90e3","repo":"thanos-io/thanos","slug":"admin-operations-are-disabled","errorCode":null,"errorMessage":"Admin operations are disabled","messagePattern":"Admin operations are disabled","errorType":"http","errorClass":"ApiError","httpStatus":400,"severity":"warning","filePath":"pkg/api/blocks/v1.go","lineNumber":98,"sourceCode":"\t\t},\n\t\tdisableCORS:            disableCORS,\n\t\tbkt:                    bkt,\n\t\tdisableAdminOperations: disableAdminOperations,\n\t}\n}\n\nfunc (bapi *BlocksAPI) Register(r *route.Router, tracer opentracing.Tracer, logger log.Logger, ins extpromhttp.InstrumentationMiddleware, logMiddleware *logging.HTTPServerMiddleware) {\n\tbapi.baseAPI.Register(r, tracer, logger, ins, logMiddleware)\n\n\tinstr := api.GetInstr(tracer, logger, ins, logMiddleware, bapi.disableCORS)\n\n\tr.Get(\"/blocks\", instr(\"blocks\", bapi.blocks))\n\tr.Post(\"/blocks/mark\", instr(\"blocks_mark\", bapi.markBlock))\n}\n\nfunc (bapi *BlocksAPI) markBlock(r *http.Request) (any, []error, *api.ApiError, func()) {\n\tif bapi.disableAdminOperations {\n\t\treturn nil, nil, &api.ApiError{Typ: api.ErrorBadData, Err: errors.New(\"Admin operations are disabled\")}, func() {}\n\t}\n\tidParam := r.FormValue(\"id\")\n\tactionParam := r.FormValue(\"action\")\n\tdetailParam := r.FormValue(\"detail\")\n\n\tif idParam == \"\" {\n\t\treturn nil, nil, &api.ApiError{Typ: api.ErrorBadData, Err: errors.New(\"ID cannot be empty\")}, func() {}\n\t}\n\n\tif actionParam == \"\" {\n\t\treturn nil, nil, &api.ApiError{Typ: api.ErrorBadData, Err: errors.New(\"Action cannot be empty\")}, func() {}\n\t}\n\n\tid, err := ulid.Parse(idParam)\n\tif err != nil {\n\t\treturn nil, nil, &api.ApiError{Typ: api.ErrorBadData, Err: errors.Errorf(\"ULID %q is not valid: %v\", idParam, err)}, func() {}\n\t}\n","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/api/blocks/v1.go#L80-L116","documentation":"The Blocks API's markBlock endpoint (POST /blocks/mark) refuses to run when the API was started with admin operations disabled (--admin.disable). Block mark/delete operations are guarded by this flag as a safety measure.","triggerScenarios":"POST /api/v1/blocks/mark while the blocks API server was constructed with disableAdminOperations=true (Thanos started with --admin.disable).","commonSituations":"Production deployments launched with --admin.disable attempting block metadata marking via API; automation tooling calling mark endpoints against a read-only store gateway/UI instance.","solutions":["Restart the Thanos component without the --admin.disable flag if admin operations are intended.","Perform block marking via the object store tooling (thanos tools bucket mark) instead of the API.","Point the automation at an instance that has admin operations enabled."],"exampleFix":"// before\nthanos sidecar --prometheus.url=http://localhost:9090 --admin.disable\n// after\nthanos sidecar --prometheus.url=http://localhost:9090   # admin ops enabled (or use `thanos tools bucket mark`)","handlingStrategy":"validation","validationCode":"// probe admin availability first\nresp, _ := http.Post(baseURL+\"/api/v1/blocks/mark\", \"application/x-www-form-urlencoded\", strings.NewReader(\"id=test&action=deletion\"))\nif resp != nil && resp.StatusCode == 400 { /* admin likely disabled; use bucket tooling */ }","typeGuard":null,"tryCatchPattern":"resp, err := http.PostForm(url, vals)\nif err != nil { return err }\nvar e struct{ Error string `json:\"error\"`; Status string `json:\"status\"` }\njson.NewDecoder(resp.Body).Decode(&e)\nif e.Status == \"error\" && strings.Contains(e.Error, \"Admin operations are disabled\") {\n    return fmt.Errorf(\"admin ops disabled on this instance; use `thanos tools bucket mark` instead\")\n}","preventionTips":["Know which Thanos instances run with --admin.disable before automating mark calls","Use `thanos tools bucket mark` for block marking against read-only deployments","Keep a dedicated admin-enabled endpoint for automation"],"tags":["http","api","permissions","thanos"],"backgroundTag":"feature-not-enabled","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}