{"record":{"id":"e5b4f238611d07f9","repo":"weaviate/weaviate","slug":"create-requires-a-namespaced-principal-on-a-namesp","errorCode":null,"errorMessage":"create requires a namespaced principal on a namespaces-enabled cluster","messagePattern":"create requires a namespaced principal on a namespaces-enabled cluster","errorType":"error_code","errorClass":null,"httpStatus":403,"severity":"error","filePath":"usecases/schema/namespacing/namespacing.go","lineNumber":32,"sourceCode":"// and to resolve them back. The helpers are pure syntax transforms except\n// ResolveRoleName, which consults a caller-supplied existence callback to fall\n// back from a namespace-local to a global role.\npackage namespacing\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n\t\"strings\"\n\n\t\"github.com/weaviate/weaviate/entities/models\"\n\t\"github.com/weaviate/weaviate/entities/schema\"\n)\n\n// ErrCreateRequiresNamespace is returned by QualifyForCreate when a global\n// (or anonymous) principal attempts a create on an NS-enabled cluster.\n// Call sites translate this into authzerrors.NewNamespaceForbidden — the namespacing\n// package stays free of auth vocabulary.\nvar ErrCreateRequiresNamespace = errors.New(\"create requires a namespaced principal on a namespaces-enabled cluster\")\n\n// ValidateNamespacePrefix rejects user-supplied class/alias names whose\n// \"<namespace>:\" prefix is malformed. Returns nil when name has no separator.\n// kind is the noun (\"class\" or \"alias\") used in the generic error message so\n// the wording matches the field the caller is validating.\n//\n// The error wording depends on the caller's context so namespaces stay\n// invisible to principals who shouldn't know about them:\n//\n//   - Namespaced principal, or NS-disabled cluster: returns a generic\n//     \"is not a valid <kind> name\" error — namespaced users should never\n//     send qualified names (the resolver adds their prefix automatically),\n//     and on NS-disabled clusters namespaces simply don't exist as a\n//     concept.\n//   - Global principal on NS-enabled cluster: returns the specific\n//     \"invalid namespace prefix\" error — these are the operators who\n//     legitimately type qualified names and benefit from an actionable\n//     message about which part is wrong.","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/schema/namespacing/namespacing.go#L14-L50","documentation":"Sentinel error returned by namespacing.QualifyForCreate when a global (or anonymous) principal attempts a create operation on a namespaces-enabled cluster. It fires during name qualification, before any storage happens: a principal without a namespace cannot have its resource names auto-prefixed, so the create is refused at the syntax/qualification layer rather than by the authz engine. Call sites (class and alias creation in usecases/schema) translate it into authzerrors.NewNamespaceForbidden, surfacing as a 403 to the client.","triggerScenarios":"Thrown at usecases/schema/namespacing/namespacing.go:32 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run the create as a principal that belongs to a namespace (namespaced API key or user) so names can be qualified","Assign the global principal a namespaced scope or perform the create through an admin confined to the target namespace","Disable namespaces on the cluster if global principals must create resources"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}