pinpoint-apm/pinpoint · warning · ResponseStatusException

Cannot delete reserved service:

Error message

Cannot delete reserved service: 

What it means

deleteService refuses to delete any service whose name is in reservedServiceRegistry, throwing ResponseStatusException with HTTP 400. Reserved services are protected from accidental removal since they are required by the platform.

Source

Thrown at service-module/src/main/java/com/navercorp/pinpoint/service/web/controller/ServiceRegistryController.java:71

    public List<String> getServiceNames() {
        return serviceRegistryService.getServiceNames();
    }

    // TODO: (minwoo) 이게 진짜 필요한지 추후 검토 필요함.
    @GetMapping("/service")
    public ResponseEntity<ServiceView> getService(@RequestParam("serviceName") @NotBlank String serviceName) {
        Service service = serviceRegistryService.getService(serviceName);
        if (service == null) {
            return ResponseEntity.noContent().build();
        }
        return ResponseEntity.ok(ServiceView.of(service));
    }

    @PreAuthorize("hasPermission(#serviceName, null, T(com.navercorp.pinpoint.web.security.PermissionChecker).PERMISSION_SERVICEAUTHORIZATION_EDIT_AUTHOR_ONLY_MANAGER)")
    @DeleteMapping("/service")
    public Response deleteService(@RequestParam("serviceName") @NotBlank String serviceName) {
        if (reservedServiceRegistry.contains(serviceName)) {
            throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
                    "Cannot delete reserved service: " + serviceName);
        }
        serviceRegistryService.deleteService(serviceName);
        return SimpleResponse.ok();
    }
}

View on GitHub (pinned to 744c3d3075)

Solutions

1. Skip reserved names in bulk-delete logic by checking reservedServiceRegistry.contains(name) first (admin-side) or filtering the list from the API.
2. Delete only user-created services.
3. If the name must be freed, change the reserved registry configuration rather than deleting via this endpoint.

Example fix

// before
deleteService("RESERVED_NAME");
// after
if (!reservedServiceRegistry.contains(name)) {
    deleteService(name);
}

if (reservedServiceRegistry.contains(serviceName)) { /* skip delete */ }

try { rest.delete("/service?serviceName=" + name); } catch (HttpClientErrorException e) { /* 400 reserved name — skip */ }

When it happens

Trigger: DELETE /service?serviceName=<reservedName> by a user holding the edit-permission-manager role for that service's authorization.

Common situations: Cleanup scripts iterating over all services and deleting them, hitting built-in/reserved services; admins mistaking reserved services for stale entries.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Cannot use reserved service name:
• No service type provided.
• Invalid serviceType. ServiceType is required
• User information validation failed to creating user informat
• there is not userId in params to delete user

AI-assisted analysis of pinpoint-apm/pinpoint@744c3d3075 (2026-09-07). Data as JSON: /api/errors/0f5368c5d20f91f2. Report an issue: GitHub.