apache/superset · error · ThemeImportError

Theme doesn't exist and user doesn't have permission to crea

Error message

Theme doesn't exist and user doesn't have permission to create themes

What it means

ThemeImportError with message 'Theme doesn't exist and user doesn't have permission to create themes' raised in the theme import helper: the imported config's uuid matches no existing Theme row (so this would be a create, not an overwrite) and the importing user lacks the can_write permission on ThemeView. Import only creates themes for users holding write access; read-only importers may solely overwrite existing themes (and even that requires can_write with overwrite=True).

Source

Thrown at superset/commands/theme/import_themes.py:49

logger = logging.getLogger(__name__)


def import_theme(config: dict[str, Any], overwrite: bool = False) -> "Theme | None":
    """Import a single theme from config dictionary"""
    from superset import db, security_manager
    from superset.models.core import Theme
    from superset.utils.core import get_user

    can_write = security_manager.can_access("can_write", "Theme")
    existing = db.session.query(Theme).filter_by(uuid=config["uuid"]).first()

    if existing:
        if not overwrite or not can_write:
            return existing
        config["id"] = existing.id
    elif not can_write:
        raise ThemeImportError(
            "Theme doesn't exist and user doesn't have permission to create themes"
        )

    # Convert json_data from dict to string if needed
    if isinstance(config.get("json_data"), dict):
        config["json_data"] = json.dumps(config["json_data"])

    # Create or update theme
    theme = Theme.import_from_dict(config, recursive=False)
    if theme.id is None:
        db.session.flush()

    # Add current user as owner if creating new theme
    if not existing and (user := get_user()):
        theme.changed_by = user
        theme.created_by = user

    return theme

View on GitHub (pinned to f4587218dd)

Solutions

  1. Grant the importing user can_write on Theme (or perform the import as Admin).
  2. Pre-create the theme in the target environment so the import resolves to an overwrite path.
  3. Remove theme entries from the import bundle if the user only needs dashboard import.
Defensive patterns

Strategy: validation

Validate before calling

can_write = security_manager.can_access("can_write", "Theme")
existing = db.session.query(Theme).filter_by(uuid=config["uuid"]).first()
if not existing and not can_write:
    raise PermissionError("import would create a theme; can_write on Theme required")

Try / catch

try:
    import_themes(configs, overwrite=True)
except ThemeImportError as ex:
    if "permission to create" in str(ex.message):
        escalate_to_admin_or_grant_can_write()

Prevention

When it happens

Trigger: Running an import (POST import endpoint or REST import with a theme payload) as a user without can_write on Theme, where the payload's config['uuid'] does not match any existing theme.

Common situations: Non-admin or custom role performing theme migration between environments where the theme does not yet exist; import bundles containing themes in addition to dashboards, executed by users with only dashboard import rights.

Related errors


AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/69ca5eafd2bfb407. Report an issue: GitHub.