apache/superset · error · DashboardsForbiddenError

Changing one or more of these dashboards is forbidden

Error message

Changing one or more of these dashboards is forbidden

What it means

DashboardsForbiddenError (ForbiddenError, 403) raised in ChartCreateCommand.validate() when, for any dashboard id in the payload, security_manager.is_editor(dash) is false — the user may see the dashboard but cannot edit (add charts to) it. The dashboard list itself was resolved successfully, so this is purely an ownership/role check, and it aborts immediately (not aggregated into the 422 list).

Source

Thrown at superset/commands/chart/create.py:88

        dashboard_ids = self._properties.get("dashboards", [])

        # Validate/Populate datasource
        try:
            datasource = get_datasource_by_id(datasource_id, datasource_type)
            self._properties["datasource_name"] = datasource.name
            security_manager.raise_for_access(datasource=datasource)
        except SupersetSecurityException as ex:
            raise ChartForbiddenError() from ex
        except ValidationError as ex:
            exceptions.append(ex)

        # Validate/Populate dashboards
        dashboards = DashboardDAO.find_by_ids(dashboard_ids)
        if len(dashboards) != len(dashboard_ids):
            exceptions.append(DashboardsNotFoundValidationError())
        for dash in dashboards:
            if not security_manager.is_editor(dash):
                raise DashboardsForbiddenError()
        self._properties["dashboards"] = dashboards

        populate_subjects(self._properties, exceptions)

        if exceptions:
            raise ChartInvalidError(exceptions=exceptions)

View on GitHub (pinned to f4587218dd)

Solutions

Have the dashboard owner add the user as an editor (dashboard > ... > Manage > Editors) or grant the role 'can write on Dashboard'.
Create the chart without the 'dashboards' field, then ask an editor to import/move it onto the dashboard.
Take ownership via the dashboard's Save-as / ownership transfer if permitted.

Example fix

# before
POST /api/v1/chart/ {"datasource_id": 7, "datasource_type": "table", "dashboards": [3], ...}

# after
POST /api/v1/chart/ {"datasource_id": 7, "datasource_type": "table", ...}  # create standalone
# then an editor adds it to dashboard 3 from the dashboard UI

Defensive patterns

Strategy: validation

Validate before calling

from superset import security_manager
from superset.daos.dashboard import DashboardDAO

dashboards = DashboardDAO.find_by_ids(dashboard_ids)
editable = all(security_manager.is_editor(d) for d in dashboards) if dashboards else True
if not editable:
    payload.pop("dashboards", None)  # create standalone chart instead

Try / catch

try:
    CreateChartCommand(properties).run()
except DashboardsForbiddenError:
    payload.pop("dashboards", None)
    chart = CreateChartCommand(payload).run()  # standalone; editor adds it later

Prevention

Have owners add the API user as a dashboard editor before scripted chart creation.
When in doubt, create charts without 'dashboards' and attach later from an authorized session.
Check is_editor semantics for your security manager before automating dashboard writes.

When it happens

Trigger: POST /api/v1/chart/ with "dashboards": [id] where the user lacks editor rights (not owner, no 'can write on Dashboard' grant); Gamma user targeting an admin-owned dashboard.

Common situations: Automated chart creation attaching to shared dashboards without prior ownership transfer; role missing dashboard-write permission; dashboards owned by a service account.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/6632b59f9dc788d7. Report an issue: GitHub.