# SQLCODE -817: Prohibited data change operation

Source: https://wndsoftware.com/mainframe-errors/sqlcode-817

### SQLCODE -817: Prohibited data change operation

SQLCODE -817 (SQLSTATE 25000) means Db2 refused a statement that would change data or the catalog, because the environment doesn't allow changes. Typical cases are an IMS inquiry-only transaction and an update at a remote server that can't take part in two-phase commit.


#### Other names for this code

Also written as `SQL -817`, `SQLCODE=-817`, `SQLCODE = -817`, `db2 -817`, `sqlstate 25000`, `SQL0817N`, `SQL0817`, `prohibited update operation`, `prohibited data change operation`.


### What it means

Db2 returns -817 before it runs the statement. The statements it covers are INSERT, UPDATE, MERGE and DELETE, plus CREATE, ALTER, DROP, GRANT and REVOKE. Older releases called it a prohibited update operation, and newer ones say prohibited data change operation. It's the same code.

Db2 for z/OS lists these situations.

- The program runs as an IMS transaction defined as inquiry-only.
- An IMS, CICS or RRSAF program tries to change data at a remote server that doesn't support two-phase commit.
- A unit of work changes data at several locations and one of them doesn't support two-phase commit.
- A BEFORE trigger's action tried to change the database.
- The package was bound with DBPROTOCOL(DRDACBF), which turns on package-based continuous block fetch. Remote changes aren't allowed then.
- A CREATE TABLE for an accelerator-only table was followed by a data change on an accelerator-only table.

Db2 for LUW uses SQL0817N with the same SQLSTATE and similar reasons. On Db2 for i, SQL0817 reads "Update operation not allowed" and carries SQLSTATE 25006, usually because the transaction is read-only.


### Common causes

- An IMS transaction defined as inquiry-only runs a program that does an INSERT, UPDATE or DELETE.
- A CICS, IMS or RRSAF program updates a table at a remote location whose server can't do two-phase commit.
- For SNA connections, the VTAM APPL definition doesn't specify SYNCLVL=SYNCPT, so two-phase commit isn't available.
- A unit of work updates two remote locations and one of them lacks two-phase commit.
- A BEFORE trigger was written to change data, which Db2 doesn't allow.
- The package was bound with DBPROTOCOL(DRDACBF) and now includes a remote update.


### How to find the problem

- Find the failing statement and note where it ran. It may have run at the local Db2 or at a remote location named by CONNECT or a three-part name.
- For IMS, ask the IMS system programmer whether the transaction is defined as inquiry-only.
- For remote work, check which product and level is at each location, and whether it supports two-phase commit through DRDA.
- Check the package's bind options in your change tool or the BIND output for DBPROTOCOL(DRDACBF).
- If a trigger is involved, read its definition in SYSIBM.SYSTRIGGERS and look for a BEFORE trigger whose body changes data.


### How to fix it

- For IMS, have the transaction's inquiry-only status changed, or move the update into a transaction that's allowed to change data.
- For remote updates, run the program locally at the server, or bring the server up to a level that supports two-phase commit.
- For SNA links, set SYNCLVL=SYNCPT on the VTAM APPL statement.
- Rebind the package without DBPROTOCOL(DRDACBF), or take the remote changes out of that package and prepare it again.
- Have the trigger rewritten so that a BEFORE trigger only sets values on the new row, and do other changes in an AFTER trigger.


### What it looks like


```text
DSNT408I SQLCODE = -817, ERROR:  THE SQL STATEMENT CANNOT BE EXECUTED BECAUSE THE
         STATEMENT WILL RESULT IN A PROHIBITED DATA CHANGE OPERATION.
DSNT418I SQLSTATE   = 25000 SQLSTATE RETURN CODE
```


### IBM documentation

[IBM documentation: -817](https://www.ibm.com/docs/en/db2-for-zos/13.0.0?topic=codes-817). Use the documentation for your installed release.

[Report a correction to WND Software](https://wndsoftware.com/contact#message).

Technical reviewer: [Albert Joseph](https://wndsoftware.com/authors/albert-joseph), WND Software.

Last reviewed 2026-10-18 by the WND Software team. Written in our own words. For the full reference, check IBM’s Db2 for z/OS documentation for your release.


### Related codes

[SQLCODE -925 COMMIT not valid in IMS, CICS or RRSAF Read →](https://wndsoftware.com/mainframe-errors/sqlcode-925)
[SQLCODE -926 ROLLBACK not valid in IMS, CICS or RRSAF Read →](https://wndsoftware.com/mainframe-errors/sqlcode-926)
[SQLCODE -842 Connection already exists Read →](https://wndsoftware.com/mainframe-errors/sqlcode-842)
[SQLCODE -30081 Communication error detected Read →](https://wndsoftware.com/mainframe-errors/sqlcode-30081)
[SQLCODE -551 Not authorized for the operation Read →](https://wndsoftware.com/mainframe-errors/sqlcode-551)

### Questions


#### Why does the program work in batch but get -817 under IMS?

In batch nothing marks the work as inquiry-only and the update is local. Under IMS the transaction definition or a remote server without two-phase commit blocks the change.


#### Is -817 an authorization problem?

No. A missing privilege gives -551. -817 means changes aren't allowed in this environment for anyone.


#### What does SQL0817 mean on IBM i?

On Db2 for i it means an update was tried in a read-only setting, with SQLSTATE 25006. Setting the transaction to read write, or removing the update, fixes it.

[Db2 SQLCODEs](https://wndsoftware.com/mainframe-errors/db2-sqlcodes) · [SQLCODE -812](https://wndsoftware.com/mainframe-errors/sqlcode-812) · [SQLCODE -818](https://wndsoftware.com/mainframe-errors/sqlcode-818)

[← All error codes](https://wndsoftware.com/mainframe-errors/)