getredash/redash · error

Public URLs are disabled.

Error message

Public URLs are disabled.

What it means

Raised by the public dashboard endpoint in redash/handlers/dashboards.py when the organization setting disable_public_urls is enabled. Even with a valid API key token, the organization has turned off anonymous/public access to dashboards.

Source

Thrown at redash/handlers/dashboards.py:286

        models.db.session.commit()

        self.record_event({"action": "archive", "object_id": dashboard.id, "object_type": "dashboard"})

        return d


class PublicDashboardResource(BaseResource):
    decorators = BaseResource.decorators + [csp_allows_embeding]

    def get(self, token):
        """
        Retrieve a public dashboard.

        :param token: An API key for a public dashboard.
        :>json array widgets: An array of arrays of :ref:`public widgets <public-widget-label>`, corresponding to the rows and columns the widgets are displayed in
        """
        if self.current_org.get_setting("disable_public_urls"):
            abort(400, message="Public URLs are disabled.")

        if not isinstance(self.current_user, models.ApiUser):
            api_key = get_object_or_404(models.ApiKey.get_by_api_key, token)
            dashboard = api_key.object
        else:
            dashboard = self.current_user.object

        return public_dashboard(dashboard)


class DashboardShareResource(BaseResource):
    def post(self, dashboard_id):
        """
        Allow anonymous access to a dashboard.

        :param dashboard_id: The numeric ID of the dashboard to share.
        :>json string public_url: The URL for anonymous access to the dashboard.
        :>json api_key: The API key to use when accessing it.

View on GitHub (pinned to ca79fe988d)

Solutions

1. Ask the org admin to clear the disable_public_urls setting if public access is intended.
2. If you are the API consumer, authenticate as a real user instead of using the public token.
3. Use the organization settings API to verify/flip the flag: check 'disable_public_urls' before relying on public links.

Example fix

curl -X POST https://redash/api/settings -H 'Authorization: Key ...' \
  -H 'Content-Type: application/json' \
  -d '{"settings":{"disable_public_urls":false}}'

settings = client.get('/api/settings')['settings']
if settings.get('disable_public_urls'):
    raise RuntimeError('Public dashboard URLs are disabled for this org')

When it happens

Trigger: GET /api/dashboards/public/<token> while the org setting 'disable_public_urls' is true (set via the settings endpoint or REDASH env config).

Common situations: Security-hardened deployments disabling public sharing; the setting being flipped org-wide after public links were already distributed; embedded dashboards suddenly breaking after an admin changes org settings.

Related errors

• Please use a user API key.
• Must provide current password to update password.
• Incorrect current password.
• Invalid JWT token
• Error during query execution. Reason: {error}

AI-assisted analysis of getredash/redash@ca79fe988d (2026-08-28). Data as JSON: /api/errors/0959b37c08102936. Report an issue: GitHub.