apache/superset · error · DatasetForbiddenError

Changing this dataset is forbidden

Error message

Changing this dataset is forbidden

What it means

DatasetForbiddenError is raised by DatasetRefreshCommand.validate() when security_manager.raise_for_editorship(self._model) throws. Refreshing a dataset's columns/metrics mutates the dataset definition, so Superset requires editorship (ownership or change-dataset capability), not just read access.

Source

Thrown at superset/commands/dataset/refresh.py:95

            except Exception as ex:
                logger.exception(
                    "Failed to detect datetime formats for dataset %s: %s",
                    self._model.table_name,
                    str(ex),
                )

        return self._model

    def validate(self) -> None:
        # Validate/populate model exists
        self._model = DatasetDAO.find_by_id(self._model_id)
        if not self._model:
            raise DatasetNotFoundError()
        # Check editorship
        try:
            security_manager.raise_for_editorship(self._model)
        except SupersetSecurityException as ex:
            raise DatasetForbiddenError() from ex

View on GitHub (pinned to f4587218dd)

Solutions

1. Add the user (or their role) to the dataset's owners list, then retry the refresh.
2. Use an account with the Admin role or a role holding change-dataset permissions.
3. If refreshing metadata should be allowed broadly, grant the role 'can overwrite on Dataset' in Roles -> Base Permissions.
4. Verify with security_manager.can_access('can_write','Dataset') before calling.

Example fix

# before
resp = client.put("/api/v1/dataset/42/_refresh", headers=read_only_auth)
# 403 Changing this dataset is forbidden

# after
client.put("/api/v1/dataset/42", {"owners": [...current, my_user_id]}, headers=admin_auth)
client.put("/api/v1/dataset/42/_refresh", headers=read_only_auth)

from superset import security_manager
from superset.daos.dataset import DatasetDAO

model = DatasetDAO.find_by_id(model_id)
assert model is not None
security_manager.raise_for_editorship(model)  # let it raise early with the rich SupersetSecurityException

try:
    DatasetRefreshCommand(model_id=model_id).run()
except DatasetForbiddenError:
    escalate_to_owner(model_id)  # do not blind-retry

When it happens

Trigger: POST/PUT to the dataset refresh action for a dataset the user can view but not edit. Typically a Gamma user hitting 'Refresh metadata' in the dataset list, or an API call with a read-only role's token.

Common situations: Analyst roles that were granted dataset access via RLS/datasource access but never made owners. Trying to refresh a shared dataset owned by another team. Custom roles cloned from Gamma lacking the 'can overwrite on Dataset' permission.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• User doesn't have permission to create or update datasets
• Changing this dataset is forbidden.
• Changing this dataset is forbidden
• You don't have access to this dataset.
• Cannot convert node type: ${node.type}

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/c1e87bc8026eb593. Report an issue: GitHub.