getredash/redash · error

You don't have permission to edit this resource.

Error message

You don't have permission to edit this resource.

What it means

Thrown by redash.permissions.require_admin_or_owner when the caller is neither an admin of the organization nor the owner of the target resource. Many user-resource endpoints (e.g. deleting or editing another user's objects) call this guard, and it aborts with HTTP 403 before the handler body runs.

Source

Thrown at redash/permissions.py:109

    return require_permission("super_admin")(fn)


def has_permission_or_owner(permission, object_owner_id):
    return int(object_owner_id) == current_user.id or current_user.has_permission(permission)


def is_admin_or_owner(object_owner_id):
    return has_permission_or_owner("admin", object_owner_id)


def require_permission_or_owner(permission, object_owner_id):
    if not has_permission_or_owner(permission, object_owner_id):
        abort(403)


def require_admin_or_owner(object_owner_id):
    if not is_admin_or_owner(object_owner_id):
        abort(403, message="You don't have permission to edit this resource.")


def can_modify(obj, user):
    return is_admin_or_owner(obj.user_id) or user.has_access(obj, ACCESS_TYPE_MODIFY)


def require_object_modify_permission(obj, user):
    if not can_modify(obj, user):
        abort(403)

View on GitHub (pinned to ca79fe988d)

Solutions

1. Perform the operation as the resource owner or with an admin account/API key
2. Have an admin grant the caller the needed permission on the object (e.g. modify access) if the code path supports can_modify
3. Hide/disable edit/delete actions in the client for users who are neither owner nor admin

Example fix

# before
requests.delete(f"{url}/api/users/{other_uid}/resources/{rid}", headers=limited_hdrs)  # 403
# after
requests.delete(f"{url}/api/users/{other_uid}/resources/{rid}", headers=admin_hdrs)

session = requests.get(f"{url}/api/session", headers=hdrs).json()
user = session.get("user", {})
is_admin_or_owner = any(g.get("type") == "admin" for g in session.get("user", {}).get("groups", [])) or user.get("id") == target_owner_id
if not is_admin_or_owner:
    raise PermissionError("caller is neither admin nor owner")

def can_manage(session_user, owner_id):
    return session_user["id"] == owner_id or "admin" in session_user.get("group_ids", ())

When it happens

Trigger: Calling an admin-or-owner-protected endpoint such as POST/DELETE on a user resource while authenticated as a non-admin user whose id differs from object_owner_id; e.g. user A deleting user B, or a viewer-tier API key hitting an edit endpoint.

Common situations: Sharing a service account API key with limited permissions across scripts; frontends leaking edit/delete buttons to non-admins; org members attempting to manage teammates' resources after permission changes removed their admin status.

Related errors

• You do not have access to data source: %s.
• You do not have access to query id %s.
• Must be admin to change groups membership.
• Python query helpers require a current user.
• Query id {} not found.

AI-assisted analysis of getredash/redash@ca79fe988d (2026-08-28). Data as JSON: /api/errors/fbb6371f7550dbb8. Report an issue: GitHub.