apache/superset · error · DatasetMetricForbiddenError

Changing this dataset is forbidden.

Error message

Changing this dataset is forbidden.

What it means

DatasetMetricForbiddenError is raised by DeleteDatasetMetricCommand.validate() when security_manager.raise_for_editorship(self._model) denies the current user the right to edit the dataset metric. Editorship means the user is an owner of the metric's parent dataset or holds a role with the change-dataset capability. The original SupersetSecurityException is chained as the cause for auditability.

Source

Thrown at superset/commands/dataset/metrics/delete.py:57

        self._model_id = model_id
        self._model: Optional[SqlMetric] = None

    @transaction(on_error=partial(on_error, reraise=DatasetMetricDeleteFailedError))
    def run(self) -> None:
        self.validate()
        assert self._model
        DatasetMetricDAO.delete([self._model])

    def validate(self) -> None:
        # Validate/populate model exists
        self._model = DatasetDAO.find_dataset_metric(self._dataset_id, self._model_id)
        if not self._model:
            raise DatasetMetricNotFoundError()
        # Check editorship
        try:
            security_manager.raise_for_editorship(self._model)
        except SupersetSecurityException as ex:
            raise DatasetMetricForbiddenError() from ex

View on GitHub (pinned to f4587218dd)

Solutions

1. Have an owner of the dataset perform the delete, or add the current user to the dataset's owners (PUT /api/v1/dataset/{id} with owners).
2. Grant the calling role the dataset-edit permission (e.g. can_edit on Dataset model, or Admin role) in List Roles.
3. Verify you are hitting the right dataset_id/metric_id pair — the 403 here comes after a successful lookup, so the IDs are valid but rights are missing.
4. If using a service token, re-issue it for a user with the required role.

Example fix

# before
curl -X DELETE -H "Authorization: Bearer $VIEWER_TOKEN" \
  https://superset/api/v1/dataset/42/metric/7
# -> 403 Changing this dataset is forbidden.

# after: perform as an owner/admin
curl -X DELETE -H "Authorization: Bearer $ADMIN_TOKEN" \
  https://superset/api/v1/dataset/42/metric/7

from superset import security_manager
from superset.daos.dataset import DatasetDAO

model = DatasetDAO.find_dataset_metric(dataset_id, metric_id)
if model is None:
    ...  # 404 path
if not security_manager.can_access("can_write", "Dataset") and user_id not in (
    o.id for o in model.table.owners
):
    abort(403, "not an editor of this dataset")

try:
    DeleteDatasetMetricCommand(dataset_id, metric_id).run()
except DatasetMetricForbiddenError:
    # surface 'ask an owner' message; do not retry with same credentials
    respond_403_with_owner_hint()

When it happens

Trigger: Calling DELETE /api/v1/dataset/{dataset_id}/metric/{metric_id} (which routes to DeleteDatasetMetricCommand) while the authenticated user is neither an owner of the dataset nor an Admin/role with dataset-edit rights. Also triggered when the metric resolves to a dataset the user can read but not edit.

Common situations: A Gamma/Analyst user with only 'can show dataset' / read access tries to prune computed metrics via the API or a script. Service accounts whose token belongs to a viewer role. Ownership changed (dataset re-owned to another team) and stale automation keeps calling the delete endpoint.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• User doesn't have permission to create or update datasets
• Changing this dataset is forbidden
• Changing this dataset is forbidden
• You don't have access to this dataset.
• Cannot convert node type: ${node.type}

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/b4dd944c358fe04a. Report an issue: GitHub.