apache/superset · error · ValidationError

JSON not valid

Error message

JSON not valid

What it means

Marshmallow field-level validator in the dashboard schemas: it parses the incoming value with json.validate_json and raises ValidationError('JSON not valid') when the bytes/string are not parseable JSON. It guards dashboard fields that are stored as raw JSON strings (e.g. the dashboard JSON parameter on PUT/POST).

Source

Thrown at superset/dashboards/schemas.py:116

            "description": "Gets a list of dashboards, use Rison or JSON query "
            "parameters for filtering, sorting, pagination and "
            " for selecting specific columns and metadata.",
        }
    },
    "info": {"get": {"summary": "Get metadata information about this API resource"}},
    "related": {
        "get": {
            "description": "Get a list of all possible related entities for a dashboard"
        }
    },
}


def validate_json(value: Union[bytes, bytearray, str]) -> None:
    try:
        json.validate_json(value)
    except json.JSONDecodeError as ex:
        raise ValidationError("JSON not valid") from ex


def validate_json_metadata(value: Union[bytes, bytearray, str]) -> None:
    if not value:
        return
    try:
        value_obj = json.loads(value)
    except json.JSONDecodeError as ex:
        raise ValidationError("JSON not valid") from ex
    errors = DashboardJSONMetadataSchema().validate(value_obj, partial=False)
    if errors:
        raise ValidationError(errors)


# Patterns for CSS constructs that can be abused to execute scripts or pull in
# remote stylesheets/resources. The custom CSS is stored verbatim and re-served
# into the dashboard page, so these are rejected at validation time. Ordinary
# styling (including ``url(...)`` referencing relative paths or ``data:`` image

View on GitHub (pinned to f4587218dd)

Solutions

1. Validate the string client-side with JSON.parse / json.loads before sending.
2. Send the field as a real JSON object in the request body where the API accepts it, rather than a pre-stringified string.
3. Check for smart quotes, trailing commas, unescaped newlines, or a BOM at the start of the value.
4. Reproduce: python -c "import json; json.loads(open('payload.txt').read())" to see the exact offset of the syntax error.

Example fix

// before
body = {"json": JSON.stringify(css) + "}"};  // broken

// after
body = {"json": JSON.stringify(css)};  // valid JSON string

function assertValidJsonString(s: string): void {
  try { JSON.parse(s); } catch (e) { throw new Error(`field is not valid JSON: ${e.message}`); }
}

function isJsonString(s: string): boolean {
  try { JSON.parse(s); return true; } catch { return false; }
}

When it happens

Trigger: POST/PUT /api/v1/dashboard/ with a json_-style field containing malformed JSON — unbalanced braces, single quotes, trailing commas, or binary garbage; also triggered when a client sends a JSON-encoded string with encoding errors.

Common situations: Hand-building the request body and stringifying twice or not at all; copy-pasting JSON with smart quotes from a doc; charset mismatch (UTF-16 output pasted as UTF-8).

Related errors

• JSON not valid
• Not a valid list
• Unsupported whisker type: ${whiskerOptions}
• Unknown Error
• Request is incorrect

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/3ec9d7c149d5f4d3. Report an issue: GitHub.