{"record":{"id":"848af2240f3c8494","repo":"dgraph-io/dgraph","slug":"cannot-delete-default-namespace","errorCode":null,"errorMessage":"Cannot delete default namespace","messagePattern":"Cannot delete default namespace","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"graphql/admin/namespace.go","lineNumber":59,"sourceCode":"\t}\n\treturn resolve.DataResult(\n\t\tm,\n\t\tmap[string]interface{}{m.Name(): map[string]interface{}{\n\t\t\t\"namespaceId\": json.Number(strconv.Itoa(int(ns))),\n\t\t\t\"message\":     \"Created namespace successfully\",\n\t\t}},\n\t\tnil,\n\t), true\n}\n\nfunc resolveDeleteNamespace(ctx context.Context, m schema.Mutation) (*resolve.Resolved, bool) {\n\treq, err := getDeleteNamespaceInput(m)\n\tif err != nil {\n\t\treturn resolve.EmptyResult(m, err), false\n\t}\n\t// No one can delete the galaxy(default) namespace.\n\tif uint64(req.NamespaceId) == x.RootNamespace {\n\t\treturn resolve.EmptyResult(m, errors.New(\"Cannot delete default namespace\")), false\n\t}\n\tif err = (&edgraph.Server{}).DeleteNamespace(ctx, uint64(req.NamespaceId)); err != nil {\n\t\treturn resolve.EmptyResult(m, err), false\n\t}\n\tdropOp := \"DROP_NS;\" + fmt.Sprintf(\"%#x\", req.NamespaceId)\n\tif err = edgraph.InsertDropRecord(ctx, dropOp); err != nil {\n\t\treturn resolve.EmptyResult(m, err), false\n\t}\n\treturn resolve.DataResult(\n\t\tm,\n\t\tmap[string]interface{}{m.Name(): map[string]interface{}{\n\t\t\t\"namespaceId\": json.Number(strconv.Itoa(req.NamespaceId)),\n\t\t\t\"message\":     \"Deleted namespace successfully\",\n\t\t}},\n\t\tnil,\n\t), true\n}\n","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/graphql/admin/namespace.go#L41-L77","documentation":"resolveDeleteNamespace refuses to delete namespace 0 (x.RootNamespace), the built-in 'galaxy' default namespace that Dgraph uses for its own administrative data. Any deleteNamespace request whose resolved NamespaceId equals the root namespace is rejected outright with this fixed message. This is an intentional safety guard, not a runtime failure.","triggerScenarios":"Invoking the deleteNamespace admin mutation with namespace omitted (defaults to root namespace 0) or explicitly set to 0.","commonSituations":"Operators writing scripts to clean up test namespaces without realizing the default/galaxy namespace can never be deleted; clients omitting the optional namespace argument and silently defaulting to 0; automation reading namespace IDs from config where 0 is a placeholder value.","solutions":["Pass a non-zero namespace in the input: { deleteNamespace(input: { namespace: 123 }) }.","Verify which namespace you actually intend to drop (use /state or the queryRootNamespace API) — never 0.","If the goal is to wipe data in the default namespace, use drop operations (DropData/DropAll) within namespace 0 instead of deleting the namespace.","Guard automation code to skip/error before calling the mutation when id == 0."],"exampleFix":"// before\nmutation { deleteNamespace(input: { namespace: 0 }) { response { message } } }\n// after\nmutation { deleteNamespace(input: { namespace: 42 }) { response { message } } }","handlingStrategy":"validation","validationCode":"function assertDeletableNamespace(nsId) {\n  if (nsId === 0 || nsId === '0' || nsId == null) {\n    throw new Error('refusing to delete default (galaxy) namespace 0');\n  }\n  return nsId;\n}","typeGuard":"function isDeletableNamespace(ns) { return ns != null && Number(ns) !== 0; }","tryCatchPattern":"try {\n  await gql(deleteNamespaceMutation, { input: { namespace } });\n} catch (e) {\n  if (String(e.message).includes('Cannot delete default namespace')) {\n    // choose the intended non-zero namespace; do not retry with 0\n  }\n}","preventionTips":["Never hardcode namespace 0 in cleanup scripts","Make namespace explicit in all admin automation (no reliance on defaults)","Use DropData/DropAll to clear data in namespace 0 instead of deleting it","Log the resolved namespace ID before calling deleteNamespace","Review which namespace your client session is bound to before destructive ops"],"tags":["graphql","namespace","multitenancy","admin-api","guard"],"backgroundTag":"protected-namespace-delete","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}