# 2F003 — prohibited_sql_statement_attempted

> Source-backed reference for PostgreSQL SQLSTATE 2F003.
---

# 2F003

## At a glance {#at-a-glance}

The fixed scan confirms this ERROR in both dblink and postgres_fdw connection paths. dblink also reports it when a command would return rows where the dblink API expects no result. The authentication variants are wrapper/connection policy paths, not proof that every prohibited SQL statement uses this code.

<!-- BEGIN SQLSTATE FACTS: generated by scripts/generate.py; do not edit -->

| Field | Value |
| --- | --- |
| SQLSTATE | `2F003` |
| Condition | `prohibited_sql_statement_attempted` |
| Status | `active` |
| Known present by | `7.4` |
| Locked snapshots | `9.0.23, 9.1.24, 9.2.24, 9.3.25, 9.4.26, 9.5.25, 9.6.24, 10.23, 11.22, 12.22, 13.23, 14.24, 15.19, 16.15, 17.11, 18.6, 19beta3` |
| Macros | `ERRCODE_S_R_E_PROHIBITED_SQL_STATEMENT_ATTEMPTED` |
| Aliases | `—` |

<!-- source facts: data/errcodes/2F003.json -->
<!-- END SQLSTATE FACTS -->

## Meaning {#meaning}

The confirmed messages include `statement returning results not allowed`, and authentication variants such as `password or GSSAPI delegated credentials required` with a detail and sometimes a hint. postgres_fdw adds detail about the user mapping and may hint at `password_required=false`; dblink has its own credential wording. Keep the producer because the same SQLSTATE covers separate APIs.

## Messages {#messages}

Confirmed messages include `statement returning results not allowed`, plus `password or GSSAPI delegated credentials required`, which carries detail and may also carry a hint depending on the path. `postgres_fdw` identifies the user mapping in its detail and one path mentions `password_required=false` in the hint; `dblink` uses its own credential wording. Because the same SQLSTATE covers separate APIs, retain the actual producer.

## Diagnosis {#diagnosis}

For dblink, identify whether the local call is a row-returning command used through a no-result API or a connection credential check. For postgres_fdw, inspect the foreign-server connection, user mapping, authentication method, and the server’s `password_required` policy when the message names them. Preserve the fixed detail/hint and do not collapse dblink and postgres_fdw into one generic wrapper.

## Response {#response}

Correct the command/API pairing or the named connection credentials and user mapping, then verify the remote operation. A remote connection attempt may not have completed; preserve the remote/local boundary before retrying. Do not change transaction policy merely because dblink or postgres_fdw reported 2F003.

## Versions {#versions}

The locked catalogue places this condition at least by PostgreSQL 7.4. The facts block lists the published snapshots; source-path status is limited to the fixed PostgreSQL 18.6 evidence below.

## Related {#related}

[`2F000`](../2f000/), [`38003`](../38003/)

## Sources {#sources}

Read the fixed [dblink.c](https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/contrib/dblink/dblink.c#L1488-L1490) and [postgres_fdw connection.c](https://github.com/postgres/postgres/blob/724edf9bde9d356724ad384a2e196edc3c9f80f7/contrib/postgres_fdw/connection.c#L468-L472) paths alongside the structured [evidence record](../data/evidence/2f003.json).