apache/superset · error · DatasetInvalidError

Dataset parameters are invalid.

Error message

Dataset parameters are invalid.

What it means

DatasetInvalidError (HTTP 422, 'Dataset parameters are invalid.') is raised by the dataset create command when its validate() step accumulated one or more ValidationError entries; the errors list in the response carries the specifics. From this region: security_manager.raise_for_access(database=..., table=...) failing (DatasetDataAccessIsNotAllowed), and populate_subjects rejecting an invalid editors/owners list (viewers is explicitly rejected because dataset DAO drops it).

Source

Thrown at superset/commands/dataset/create.py:128

                        f"Invalid SQL: {ex.error.message}",
                        field_name="sql",
                    )
                )
        elif database:
            try:
                security_manager.raise_for_access(
                    database=database,
                    table=table,
                )
            except SupersetSecurityException as ex:
                exceptions.append(DatasetDataAccessIsNotAllowed(ex.error.message))

        # Datasets have editors only — there is no ``sqlatable_viewers`` table,
        # so a ``viewers`` key would be dropped by the DAO's ``setattr`` loop.
        populate_subjects(self._properties, exceptions, include_viewers=False)

        if exceptions:
            raise DatasetInvalidError(exceptions=exceptions)

View on GitHub (pinned to f4587218dd)

Solutions

1. Read the nested `errors` array in the 422 response — each entry names the offending field (e.g., 'sql' for access denied, 'editors', 'viewers').
2. Remove the `viewers` key from the payload; use `editors` (and `owners`) for datasets.
3. Grant the calling user access to the database/table (or have an admin create the dataset) when the error is DatasetDataAccessIsNotAllowed.
4. Verify every editors/owners entry resolves: usernames exist, roles exist, and ids are well-formed.

Example fix

// before
{
  "database": 1,
  "table_name": "sales",
  "viewers": [{"username": "alice"}]  // rejected: datasets have no viewers
}

// after
{
  "database": 1,
  "table_name": "sales",
  "editors": [{"username": "alice"}]
}

# Pre-validate a create payload the way the command does
from superset import security_manager
from superset.daos.dataset import DatasetDAO

def create_payload_valid(properties: dict) -> list[str]:
    problems = []
    if "viewers" in properties:
        problems.append("datasets accept editors/owners only, not viewers")
    database = properties.get("database")
    table = properties.get("table_name")
    if database and table:
        try:
            security_manager.raise_for_access(
                database=database, table=table
            )
        except Exception:
            problems.append("no access to database/table")
    return problems  # empty == likely to pass

from superset.commands.dataset.exceptions import DatasetInvalidError
try:
    CreateDatasetCommand(properties).run()
except DatasetInvalidError as ex:
    # 422 with nested per-field errors: map each to its form field
    for err in ex.normalized_errors():
        mark_form_error(err.get("error_data", {}).get("field_name", "base"), err["message"])

When it happens

Trigger: POST /api/v1/dataset/ by a user lacking access to the target database/table; passing a `viewers` key (datasets have editors only, so it is a validation error); passing editors/owners entries that don't resolve to users/roles; combined with other checks earlier in validate() — duplicate table, table not found on the database.

Common situations: Gamma users creating datasets over databases they can only query through RLS or not at all; API payloads copied from dashboard imports that include viewers; usernames/role names that were renamed or deleted.

Related errors

• Changing this dataset is forbidden.
• Changing this dataset is forbidden
• You don't have access to this dataset.
• Dataset parameters are invalid.
• Dataset column not found.

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/20fac8d8a2db2006. Report an issue: GitHub.