{"record":{"id":"c1e87bc8026eb593","repo":"apache/superset","slug":"changing-this-dataset-is-forbidden-c1e87b","errorCode":null,"errorMessage":"Changing this dataset is forbidden","messagePattern":"Changing this dataset is forbidden","errorType":"exception","errorClass":"DatasetForbiddenError","httpStatus":403,"severity":"error","filePath":"superset/commands/dataset/refresh.py","lineNumber":95,"sourceCode":"            except Exception as ex:\n                logger.exception(\n                    \"Failed to detect datetime formats for dataset %s: %s\",\n                    self._model.table_name,\n                    str(ex),\n                )\n\n        return self._model\n\n    def validate(self) -> None:\n        # Validate/populate model exists\n        self._model = DatasetDAO.find_by_id(self._model_id)\n        if not self._model:\n            raise DatasetNotFoundError()\n        # Check editorship\n        try:\n            security_manager.raise_for_editorship(self._model)\n        except SupersetSecurityException as ex:\n            raise DatasetForbiddenError() from ex\n","sourceCodeStart":77,"sourceCodeEnd":96,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/dataset/refresh.py#L77-L96","documentation":"DatasetForbiddenError is raised by DatasetRefreshCommand.validate() when security_manager.raise_for_editorship(self._model) throws. Refreshing a dataset's columns/metrics mutates the dataset definition, so Superset requires editorship (ownership or change-dataset capability), not just read access.","triggerScenarios":"POST/PUT to the dataset refresh action for a dataset the user can view but not edit. Typically a Gamma user hitting 'Refresh metadata' in the dataset list, or an API call with a read-only role's token.","commonSituations":"Analyst roles that were granted dataset access via RLS/datasource access but never made owners. Trying to refresh a shared dataset owned by another team. Custom roles cloned from Gamma lacking the 'can overwrite on Dataset' permission.","solutions":["Add the user (or their role) to the dataset's owners list, then retry the refresh.","Use an account with the Admin role or a role holding change-dataset permissions.","If refreshing metadata should be allowed broadly, grant the role 'can overwrite on Dataset' in Roles -> Base Permissions.","Verify with security_manager.can_access('can_write','Dataset') before calling."],"exampleFix":"# before\nresp = client.put(\"/api/v1/dataset/42/_refresh\", headers=read_only_auth)\n# 403 Changing this dataset is forbidden\n\n# after\nclient.put(\"/api/v1/dataset/42\", {\"owners\": [...current, my_user_id]}, headers=admin_auth)\nclient.put(\"/api/v1/dataset/42/_refresh\", headers=read_only_auth)","handlingStrategy":"validation","validationCode":"from superset import security_manager\nfrom superset.daos.dataset import DatasetDAO\n\nmodel = DatasetDAO.find_by_id(model_id)\nassert model is not None\nsecurity_manager.raise_for_editorship(model)  # let it raise early with the rich SupersetSecurityException","typeGuard":null,"tryCatchPattern":"try:\n    DatasetRefreshCommand(model_id=model_id).run()\nexcept DatasetForbiddenError:\n    escalate_to_owner(model_id)  # do not blind-retry","preventionTips":["Grant refresh responsibility only to owner-level roles.","Test permissions with can_access before large batch refreshes.","Keep an owners map in CMDB so scripts know whom to notify."],"tags":["permissions","rbac","dataset","refresh"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}