getredash/redash · error

You don't have permission to edit this resource.

Error message

You don't have permission to edit this resource.

What it means

Thrown by redash.permissions.require_admin_or_owner when the caller is neither an admin of the organization nor the owner of the target resource. Many user-resource endpoints (e.g. deleting or editing another user's objects) call this guard, and it aborts with HTTP 403 before the handler body runs.

Solutions

1. Perform the operation as the resource owner or with an admin account/API key
2. Have an admin grant the caller the needed permission on the object (e.g. modify access) if the code path supports can_modify
3. Hide/disable edit/delete actions in the client for users who are neither owner nor admin

Example fix

# before
requests.delete(f"{url}/api/users/{other_uid}/resources/{rid}", headers=limited_hdrs)  # 403
# after
requests.delete(f"{url}/api/users/{other_uid}/resources/{rid}", headers=admin_hdrs)

session = requests.get(f"{url}/api/session", headers=hdrs).json()
user = session.get("user", {})
is_admin_or_owner = any(g.get("type") == "admin" for g in session.get("user", {}).get("groups", [])) or user.get("id") == target_owner_id
if not is_admin_or_owner:
    raise PermissionError("caller is neither admin nor owner")

def can_manage(session_user, owner_id):
    return session_user["id"] == owner_id or "admin" in session_user.get("group_ids", ())

When it happens

Trigger: Calling an admin-or-owner-protected endpoint such as POST/DELETE on a user resource while authenticated as a non-admin user whose id differs from object_owner_id; e.g. user A deleting user B, or a viewer-tier API key hitting an edit endpoint.

Common situations: Sharing a service account API key with limited permissions across scripts; frontends leaking edit/delete buttons to non-admins; org members attempting to manage teammates' resources after permission changes removed their admin status.

Related errors

• Must be admin to change groups membership.
• You do not have access to data source
• You do not have access to query id
• Can't delete built-in groups.
• Can't modify built-in groups.

AI-assisted analysis of getredash/redash@ca79fe988d (2026-08-28). Data as JSON: /api/errors/fbb6371f7550dbb8. Report an issue: GitHub.

Appendix: source

Thrown at redash/permissions.py:109

    return require_permission("super_admin")(fn)


def has_permission_or_owner(permission, object_owner_id):
    return int(object_owner_id) == current_user.id or current_user.has_permission(permission)


def is_admin_or_owner(object_owner_id):
    return has_permission_or_owner("admin", object_owner_id)


def require_permission_or_owner(permission, object_owner_id):
    if not has_permission_or_owner(permission, object_owner_id):
        abort(403)


def require_admin_or_owner(object_owner_id):
    if not is_admin_or_owner(object_owner_id):
        abort(403, message="You don't have permission to edit this resource.")


def can_modify(obj, user):
    return is_admin_or_owner(obj.user_id) or user.has_access(obj, ACCESS_TYPE_MODIFY)


def require_object_modify_permission(obj, user):
    if not can_modify(obj, user):
        abort(403)

View on GitHub (pinned to ca79fe988d)