getredash/redash · error

Unknown access type.

Error message

Unknown access type.

What it means

Raised by PermissionResource.post in redash/handlers/permissions.py when the access_type in the request body is not in the ACCESS_TYPES set (modify being the typical supported type). It guards the generic ACL-granting endpoint used by queries and dashboards.

Source

Thrown at redash/handlers/permissions.py:47

        result = defaultdict(list)

        for perm in permissions:
            result[perm.access_type].append(perm.grantee.to_dict())

        return result

    def post(self, object_type, object_id):
        model = get_model_from_type(object_type)
        obj = get_object_or_404(model.get_by_id_and_org, object_id, self.current_org)

        require_admin_or_owner(obj.user_id)

        req = request.get_json(True)

        access_type = req["access_type"]

        if access_type not in ACCESS_TYPES:
            abort(400, message="Unknown access type.")

        try:
            grantee = User.get_by_id_and_org(req["user_id"], self.current_org)
        except NoResultFound:
            abort(400, message="User not found.")

        permission = AccessPermission.grant(obj, access_type, grantee, self.current_user)
        db.session.commit()

        self.record_event(
            {
                "action": "grant_permission",
                "object_id": object_id,
                "object_type": object_type,
                "grantee": grantee.id,
                "access_type": access_type,
            }
        )

View on GitHub (pinned to ca79fe988d)

Solutions

1. Use an allowed access_type — for granting, 'modify' is the supported value in this Redash version.
2. Inspect ACCESS_TYPES in redash/handlers/permissions.py for your version to confirm the vocabulary.
3. Check the API response body; the 400 clearly indicates the value was rejected.

Example fix

# before
client.post(f'/api/queries/{qid}/permissions', json={'user_id': uid, 'access_type': 'write'})

# after
client.post(f'/api/queries/{qid}/permissions', json={'user_id': uid, 'access_type': 'modify'})

ALLOWED = {'modify'}
if access_type not in ALLOWED:
    raise ValueError(f'unsupported access_type: {access_type}')

def is_valid_access_type(value: str) -> bool:
    return value in {'modify'}

When it happens

Trigger: POST /api/<object_type>/<id>/permissions with {"access_type": "write"} or any value other than the allowed ones (e.g. 'modify').

Common situations: Guessing permission names from other systems ('read'/'write'/'admin') instead of Redash's vocabulary; version drift where the allowed access types changed; typos in automation scripts.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• You do not have access to query id {}.
• Can't modify built-in groups.
• User not found.
• You do not have access to data source: %s.
• You do not have access to query id %s.

AI-assisted analysis of getredash/redash@ca79fe988d (2026-08-28). Data as JSON: /api/errors/4696af2cbf01ed0d. Report an issue: GitHub.