{"record":{"id":"0959b37c08102936","repo":"getredash/redash","slug":"public-urls-are-disabled","errorCode":null,"errorMessage":"Public URLs are disabled.","messagePattern":"Public URLs are disabled\\.","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"redash/handlers/dashboards.py","lineNumber":286,"sourceCode":"        models.db.session.commit()\n\n        self.record_event({\"action\": \"archive\", \"object_id\": dashboard.id, \"object_type\": \"dashboard\"})\n\n        return d\n\n\nclass PublicDashboardResource(BaseResource):\n    decorators = BaseResource.decorators + [csp_allows_embeding]\n\n    def get(self, token):\n        \"\"\"\n        Retrieve a public dashboard.\n\n        :param token: An API key for a public dashboard.\n        :>json array widgets: An array of arrays of :ref:`public widgets <public-widget-label>`, corresponding to the rows and columns the widgets are displayed in\n        \"\"\"\n        if self.current_org.get_setting(\"disable_public_urls\"):\n            abort(400, message=\"Public URLs are disabled.\")\n\n        if not isinstance(self.current_user, models.ApiUser):\n            api_key = get_object_or_404(models.ApiKey.get_by_api_key, token)\n            dashboard = api_key.object\n        else:\n            dashboard = self.current_user.object\n\n        return public_dashboard(dashboard)\n\n\nclass DashboardShareResource(BaseResource):\n    def post(self, dashboard_id):\n        \"\"\"\n        Allow anonymous access to a dashboard.\n\n        :param dashboard_id: The numeric ID of the dashboard to share.\n        :>json string public_url: The URL for anonymous access to the dashboard.\n        :>json api_key: The API key to use when accessing it.","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/getredash/redash/blob/ca79fe988d81cdac9675b412f3dfcab107bc1fbc/redash/handlers/dashboards.py#L268-L304","documentation":"Raised by the public dashboard endpoint in redash/handlers/dashboards.py when the organization setting disable_public_urls is enabled. Even with a valid API key token, the organization has turned off anonymous/public access to dashboards.","triggerScenarios":"GET /api/dashboards/public/<token> while the org setting 'disable_public_urls' is true (set via the settings endpoint or REDASH env config).","commonSituations":"Security-hardened deployments disabling public sharing; the setting being flipped org-wide after public links were already distributed; embedded dashboards suddenly breaking after an admin changes org settings.","solutions":["Ask the org admin to clear the disable_public_urls setting if public access is intended.","If you are the API consumer, authenticate as a real user instead of using the public token.","Use the organization settings API to verify/flip the flag: check 'disable_public_urls' before relying on public links."],"exampleFix":"curl -X POST https://redash/api/settings -H 'Authorization: Key ...' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"settings\":{\"disable_public_urls\":false}}'","handlingStrategy":"validation","validationCode":"settings = client.get('/api/settings')['settings']\nif settings.get('disable_public_urls'):\n    raise RuntimeError('Public dashboard URLs are disabled for this org')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check org settings before distributing public dashboard links.","Monitor org settings changes when embedding public dashboards in products."],"tags":["redash","dashboards","public-urls","settings","forbidden"],"backgroundTag":"feature-disabled-by-configuration","analyzedSha":"ca79fe988d81cdac9675b412f3dfcab107bc1fbc","analyzedAt":"2026-08-28T18:32:34.637Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}