apache/superset · error · SubjectsNotFoundValidationError

Subjects are invalid

Error message

Subjects are invalid

What it means

Raised in superset.commands.utils get_extra_subjects/subject resolution when a subject ID in owners/editors lists does not resolve via get_subject(). Superset validates every supplied subject ID (user or role) for chart/dashboard commands; any unknown ID raises SubjectsNotFoundValidationError ('Subjects are invalid').

Source

Thrown at superset/commands/utils.py:95

            user_subject = get_user_subject(user_id)
            return [user_subject] if user_subject else []
        return []

    if ensure_no_lockout and not security_manager.is_admin() and user_id:
        user_subject = get_user_subject(user_id)
        if (
            user_subject
            and user_subject.id not in subject_ids
            and not _has_extra_editors_resolver()
        ):
            user_subject_ids = set(get_user_subject_ids(user_id))
            if not (user_subject_ids & set(subject_ids)):
                subjects.append(user_subject)

    for sid in subject_ids:
        subject = get_subject(sid)
        if not subject:
            raise SubjectsNotFoundValidationError(field_name)
        subjects.append(subject)
    return subjects


def compute_subject_list(
    current_subjects: list[Subject] | None,
    new_subject_ids: list[int] | None,
    ensure_no_lockout: bool = False,
    field_name: str = "subjects",
) -> list[Subject]:
    """
    Helper function for update commands, to properly handle the subjects list.
    Preserve the previous configuration unless included in the update payload.

    :param current_subjects: list of current subjects
    :param new_subject_ids: list of new subject ids specified in the update payload
    :param ensure_no_lockout: prevent non-admins from removing themselves
    :param field_name: field name for validation errors

View on GitHub (pinned to f4587218dd)

Solutions

1. Validate every subject ID against /api/v1/users or /api/v1/roles before submitting the payload.
2. Strip deleted users from owner lists; re-resolve owners by username instead of ID.
3. If the error appears during dashboard copy, update the tooling to filter owners to existing subjects first.

Example fix

# before
payload = {"owners": [1, 2, 99999]}  # 99999 deleted

# after
existing = {u.id for u in UserDAO.find_users(payload_owners)}
payload = {"owners": [i for i in payload_owners if i in existing]}

from superset.commands.utils import get_subject
missing = [sid for sid in subject_ids if get_subject(sid) is None]
if missing:
    raise ValueError(f"unknown subject ids: {missing}")

from superset.commands.exceptions import SubjectsNotFoundValidationError
try:
    cmd.run()
except SubjectsNotFoundValidationError as e:
    prune_bad_subjects_and_retry(e)

When it happens

Trigger: POST/PUT on chart or dashboard APIs with an 'owners' or (with feature-flagged extra editors) subjects list containing a user/role ID that does not exist — e.g. a deleted user, a wrong integer, or a role ID passed where a user ID was expected.

Common situations: Copying/duplicating dashboards via API with owner lists built from another environment; users removed by LDAP/SCIM sync but still referenced in payload; scripts transferring ownership to hardcoded IDs.

Related errors

• Regular RLS filters require at least one subject.
• Regular RLS filters require at least one subject.
• Theme not found.
• Theme not found.
• Cannot modify system themes.

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/74cbded3054451b0. Report an issue: GitHub.