apache/superset · error · DatasetForbiddenError

Changing this dataset is forbidden

Error message

Changing this dataset is forbidden

What it means

DatasetForbiddenError is raised by UpdateDatasetCommand.validate() when security_manager.raise_for_editorship(self._model) throws a SupersetSecurityException. Updating a dataset requires the user to be an owner or have write permission on datasets; read access is not enough.

Source

Thrown at superset/commands/dataset/update.py:111

    )
    def run(self) -> Model:
        self.validate()
        assert self._model
        return DatasetDAO.update(self._model, attributes=self._properties)

    def validate(self) -> None:
        exceptions: list[ValidationError] = []

        # Validate/populate model exists
        self._model = DatasetDAO.find_by_id(self._model_id)
        if not self._model:
            raise DatasetNotFoundError()

        # Check permission to update the dataset
        try:
            security_manager.raise_for_editorship(self._model)
        except SupersetSecurityException as ex:
            raise DatasetForbiddenError() from ex

        # Validate/Populate editors
        compute_subjects(self._model, self._properties, exceptions)

        self._validate_dataset_source(exceptions)
        self._validate_semantics(exceptions)

        if exceptions:
            raise DatasetInvalidError(exceptions=exceptions)

    def _validate_dataset_source(self, exceptions: list[ValidationError]) -> None:
        # we know we have a valid model
        self._model = cast(SqlaTable, self._model)
        database_id = self._properties.pop("database_id", None)
        new_db_connection = self._get_new_database_connection(database_id, exceptions)
        db = new_db_connection or self._model.database
        database_changed = new_db_connection is not None

View on GitHub (pinned to f4587218dd)

Solutions

1. Add the acting user to owners via an admin: PUT /api/v1/dataset/{id} with the merged owners list.
2. Grant the role 'can edit on Dataset' / appropriate write permission in the RBAC editor.
3. Run the update as an Admin.
4. Audit ownership in bulk: GET /api/v1/dataset?q=(table_name:eq:...) and inspect owners.

Example fix

# before
client.put("/api/v1/dataset/42", json={"description": "x"}, auth=viewer)
# 403 Changing this dataset is forbidden

# after
client.put("/api/v1/dataset/42", json={"description": "x"}, auth=admin)

from superset import security_manager

model = DatasetDAO.find_by_id(model_id)
assert model is not None
try:
    security_manager.raise_for_editorship(model)
except SupersetSecurityException:
    request_ownership(model)  # ask an admin to add you to owners

try:
    UpdateDatasetCommand(user, model_id, properties).run()
except DatasetForbiddenError:
    notify_admin_for_ownership(model_id)

When it happens

Trigger: PUT/PATCH /api/v1/dataset/{id} (or saving the dataset editor UI) as a user who is not in owners and whose role lacks the dataset write capability.

Common situations: Gamma-derived roles that can explore charts on a dataset but were never granted edit. Ownership reassigned during offboarding; the departed user's scripts still hold a token. Embedded/guest tokens used against an endpoint they cannot access.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• User doesn't have permission to create or update datasets
• Changing this dataset is forbidden.
• Changing this dataset is forbidden
• You don't have access to this dataset.
• Cannot convert node type: ${node.type}

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/08830cb3e095d74a. Report an issue: GitHub.