apache/superset · error · TagInvalidError

Tag parameters are invalid.

Error message

Tag parameters are invalid.

What it means

DeleteTaggedObjectCommand.validate() collects problems — missing object_id/object_type, unknown tag name, missing _validate_object_access failure, or a tagged-object row not found (TaggedObjectNotFoundError) — and raises TagInvalidError(exceptions=exceptions) when any are present (delete.py:92). 'Tag parameters are invalid.' here means the delete-tagged-object request parameters failed validation.

Source

Thrown at superset/commands/tag/delete.py:92

                    )
                )
            else:
                # Validate user has access to the target object
                self._validate_object_access(object_type, self._object_id, exceptions)

                tagged_object = TagDAO.find_tagged_object(
                    object_type=object_type, object_id=self._object_id, tag_id=tag.id
                )
                if tagged_object is None:
                    exceptions.append(
                        TaggedObjectNotFoundError(
                            object_id=self._object_id,
                            object_type=object_type.name,
                            tag_name=self._tag,
                        )
                    )
        if exceptions:
            raise TagInvalidError(exceptions=exceptions)

    def _validate_object_access(
        self, object_type: ObjectType, object_id: int, exceptions: list[Any]
    ) -> None:
        """Validate that the current user has access to the target object."""
        # Skip base filter so we can distinguish "not found" from "no access"
        target_object = to_object_model(object_type, object_id, skip_base_filter=True)
        if not target_object:
            # Allow operation on stale references; no object to authorize against
            return

        try:
            if object_type == ObjectType.dashboard:
                security_manager.raise_for_access(dashboard=target_object)
            elif object_type == ObjectType.chart:
                security_manager.raise_for_access(chart=target_object)
            elif object_type == ObjectType.query:
                security_manager.raise_for_access(query=target_object)

View on GitHub (pinned to f4587218dd)

Solutions

  1. Check the nested exceptions to identify the concrete failure (missing arg vs tag not found vs tagged object not found vs access)
  2. Confirm the tag name exists and is applied to that exact object before deleting; refresh the UI state if it may be stale
  3. Pass all required parameters with valid values (non-empty object_type and object_id)
Defensive patterns

Strategy: validation

Validate before calling

from superset.daos.tag import TagDAO
from superset.commands.tag.utils import to_object_type

def deletable(object_type: str, object_id: int, tag: str) -> bool:
    ot = to_object_type(object_type)
    if ot is None or not object_id:
        return False
    t = TagDAO.find_by_name(tag)
    return t is not None and TagDAO.find_tagged_object(
        object_type=ot, object_id=object_id, tag_id=t.id
    ) is not None

Try / catch

try:
    DeleteTaggedObjectCommand(...).run()
except TagInvalidError as ex:
    if any(isinstance(e, TaggedObjectNotFoundError) for e in ex.exceptions):
        treat_as_already_removed()  # idempotent no-op

Prevention

When it happens

Trigger: DELETE /api/v1/tag/... with an empty object_id or object_type; a tag name that does not exist (TagDAO.find_by_name returns nothing); the (object_type, object_id, tag) combination has no TaggedObject row; or the user lacks access to the target object.

Common situations: UI attempting to remove a tag that was already deleted elsewhere (race with another user); stale client state after tag management in another tab; API scripts deleting by guessed ids.

Related errors

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/1e09e049ba38bc6f. Report an issue: GitHub.