apache/superset · error · DatasetColumnForbiddenError

Changing this dataset is forbidden.

Error message

Changing this dataset is forbidden.

What it means

DatasetColumnForbiddenError (HTTP 403, 'Changing this dataset is forbidden.') is raised when security_manager.raise_for_editorship(self._model) throws a SupersetSecurityException during column deletion. Only users who are editors (or owners) of the dataset may mutate its columns; read access to the dataset or the database is not sufficient.

Source

Thrown at superset/commands/dataset/columns/delete.py:57

        self._model_id = model_id
        self._model: Optional[TableColumn] = None

    @transaction(on_error=partial(on_error, reraise=DatasetColumnDeleteFailedError))
    def run(self) -> None:
        self.validate()
        assert self._model
        DatasetColumnDAO.delete([self._model])

    def validate(self) -> None:
        # Validate/populate model exists
        self._model = DatasetDAO.find_dataset_column(self._dataset_id, self._model_id)
        if not self._model:
            raise DatasetColumnNotFoundError()
        # Check editorship
        try:
            security_manager.raise_for_editorship(self._model)
        except SupersetSecurityException as ex:
            raise DatasetColumnForbiddenError() from ex

View on GitHub (pinned to f4587218dd)

Solutions

1. Have an owner/editor of the dataset perform the deletion, or add the calling user to the dataset's editors/owners first (PATCH the dataset or use the roles UI).
2. Verify current ownership with GET /api/v1/dataset/<id> (owners/editors fields) before retrying.
3. Admins can perform the operation directly since Admin is fully trusted.

# Check editorship before attempting the delete
from superset import security_manager
from superset.daos.dataset import DatasetDAO

def can_edit_column(dataset_id: int, column_id: int) -> bool:
    col = DatasetDAO.find_dataset_column(dataset_id, column_id)
    if col is None:
        return False
    try:
        security_manager.raise_for_editorship(col)
        return True
    except Exception:
        return False

from superset.commands.dataset.columns.exceptions import (
    DatasetColumnForbiddenError, DatasetColumnNotFoundError,
)
try:
    DeleteDatasetColumnCommand(dataset_id, column_id).run()
except DatasetColumnForbiddenError:
    prompt_user_to_contact_owner(dataset_id)  # 403: not editor — never retry
except DatasetColumnNotFoundError:
    pass

When it happens

Trigger: DELETE /api/v1/dataset/<dataset_id>/column/<column_id> by a user who can view the dataset but is not in its editors/owners; a Gamma user without the dataset-owner grant; ownership transferred away from the calling user before the request.

Common situations: Curator/viewer roles attempting schema cleanup; ownership reassigned during offboarding; service accounts that were granted read-only dataset access being reused for mutation calls.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Changing this dataset is forbidden
• You don't have access to this dataset.
• Dataset column not found.
• Dataset parameters are invalid.
• User doesn't have permission to create or update databases

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/1710a6a87b3afc46. Report an issue: GitHub.