What causes "Tag parameters are invalid." in apache/superset?

Inspect the nested exceptions list in the error payload — it itemizes exactly which parameter failed

apache/superset · error · TagInvalidError

Tag parameters are invalid.

Error message

Tag parameters are invalid.

What it means

CreateCustomTagCommand.validate() accumulates failures (object_id == 0, unmapped object type, object access denied) and, when the list is non-empty, raises TagInvalidError(exceptions=exceptions) (create.py:73). 'Tag parameters are invalid.' is the aggregate message shown when the request parameters fail one or more validation rules.

Source

Thrown at superset/commands/tag/create.py:73

    def validate(self) -> None:
        exceptions = []
        # Validate object_id
        if self._object_id == 0:
            exceptions.append(TagCreateFailedError())
        # Validate object type
        object_type = to_object_type(self._object_type)
        if not object_type:
            exceptions.append(
                TagCreateFailedError(f"invalid object type {self._object_type}")
            )

        # Validate user has access to the target object
        if object_type:
            self._validate_object_access(object_type, self._object_id, exceptions)

        if exceptions:
            raise TagInvalidError(exceptions=exceptions)

    def _validate_object_access(
        self, object_type: ObjectType, object_id: int, exceptions: list[Any]
    ) -> None:
        """Validate that the current user has access to the target object."""
        # Skip base filter so we can distinguish "not found" from "no access"
        target_object = to_object_model(object_type, object_id, skip_base_filter=True)
        if not target_object:
            # Allow operation on stale references; no object to authorize against
            return

        try:
            if object_type == ObjectType.dashboard:
                security_manager.raise_for_access(dashboard=target_object)
            elif object_type == ObjectType.chart:
                security_manager.raise_for_access(chart=target_object)
            elif object_type == ObjectType.query:
                security_manager.raise_for_access(query=target_object)

View on GitHub (pinned to f4587218dd)

Solutions

Inspect the nested exceptions list in the error payload — it itemizes exactly which parameter failed
Supply a valid non-zero object_id and a recognized object_type
If access validation failed, tag an object you own/can modify, or request the needed permission from an admin

Example fix

# before
{"object_type": "dashboard", "object_id": 0, "tags": ["important"]}
# after
{"object_type": "dashboard", "object_id": 42, "tags": ["important"]}

Defensive patterns

Strategy: validation

Validate before calling

def valid_tag_request(object_type: str, object_id: int) -> bool:
    return (
        bool(object_id)
        and object_id > 0
        and to_object_type(object_type) is not None
    )

Try / catch

try:
    CreateCustomTagCommand(...).run()
except TagInvalidError as ex:
    for sub in ex.exceptions:
        handle_each_validation_failure(sub)

Prevention

Always parse the nested exceptions array — it pinpoints the bad parameter
Never send 0 or None ids; guard in the client before POST
Confirm modify permission on the target object before tagging it

When it happens

Trigger: POST /api/v1/tag/ with object_id=0; object_type not convertible by to_object_type; or the caller lacks permission to modify the target object (surfaced by _validate_object_access).

Common situations: Frontend sends a default/zero id for an unsaved object; clients passing arbitrary object_type strings; a user tagging an object they can read but not modify.

Related errors

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/57eaaab1983d6486. Report an issue: GitHub.