-
- );
-}
-```
-
-Use in MDX:
-
-```mdx
-import FeatureCard from '@site/src/components/FeatureCard';
-
-{title}
-{description}
-![]({useBaseUrl("/img/tutorial/tutorial_01_add_database_connection.png")})
-```
-
-**Key patterns:**
-- Import Docusaurus hooks for dynamic URLs
-- Use of admonitions (:::tip) for helpful information
-- Screenshots with useBaseUrl for proper path resolution
-- Clear section hierarchy with ### subheadings
-- Step-by-step visual guides
-
-### Example: API Documentation Pattern
-From `docs/api.mdx`:
-
-```mdx
-import SwaggerUI from "swagger-ui-react";
-import "swagger-ui-react/swagger-ui.css";
-
-## API Documentation
-
-![]({useBaseUrl("/img/feature-screenshot.png")})
-
-// With caption
-![Dashboard view]({useBaseUrl("/img/dashboard.png")})
- -
-{countriesData.countries.map((country, index) => (
-
- {country} -))} -
| Flag | -Default | -Description | -
|---|---|---|
{flag.name} |
- {flag.default ? 'True' : 'False'} |
- - {flag.description} - {flag.docs && ( - <> (docs) - )} - | -
(Claude, ChatGPT, etc.)"] -- "MCP protocol
(HTTP + JSON-RPC)" --> B["MCP Server
(:5008/mcp)"] - B -- "Superset context
(app, db, RBAC)" --> C["Superset
(:8088)"] - C --> D[("Database
(Postgres)")] -``` - ---- - -## Quick Start - -Get the MCP server running locally and connect an AI client in three steps. - -### 1. Start the MCP server - -The MCP server runs as a separate process alongside Superset: - -```bash -superset mcp run --host 127.0.0.1 --port 5008 -``` - -| Flag | Default | Description | -|------|---------|-------------| -| `--host` | `127.0.0.1` | Host to bind to | -| `--port` | `5008` | Port to bind to | -| `--debug` | off | Enable debug logging | - -The endpoint is available at `http://
set?"} - F -- Yes --> CF["Custom Auth Provider"] - F -- No --> AE{"MCP_AUTH_ENABLED?"} - AE -- "True" --> JWT["JWT Validation"] - AE -- "False" --> DU["Dev Mode
(MCP_DEV_USERNAME)"] - - JWT --> ALG{"MCP_JWT_ALGORITHM"} - ALG -- "RS256 + JWKS" --> JWKS["Fetch keys from
MCP_JWKS_URI"] - ALG -- "RS256 + static" --> PK["Use
MCP_JWT_PUBLIC_KEY"] - ALG -- "HS256" --> SEC["Use
MCP_JWT_SECRET"] - - JWKS --> V["Validate token
(exp, iss, aud, scopes)"] - PK --> V - SEC --> V - V --> UR["Resolve Superset user
from token claims"] - UR --> OK["Authenticated request"] - CF --> OK - DU --> OK -``` - -### Development Mode (No Auth) - -Disable authentication and use a fixed user: - -```python -# superset_config.py -MCP_AUTH_ENABLED = False -MCP_DEV_USERNAME = "admin" -``` - -All operations run as the configured user. - -:::warning -Never use development mode in production. Always enable authentication for any internet-facing deployment. -::: - -### JWT Authentication - -For production, enable JWT-based authentication. The MCP server validates a Bearer token on every request. - -#### Option A: RS256 with JWKS endpoint - -The most common setup for OAuth 2.0 / OIDC providers that publish a JWKS (JSON Web Key Set) endpoint: - -```python -# superset_config.py -MCP_AUTH_ENABLED = True -MCP_JWT_ALGORITHM = "RS256" -MCP_JWKS_URI = "https://your-identity-provider.com/.well-known/jwks.json" -MCP_JWT_ISSUER = "https://your-identity-provider.com/" -MCP_JWT_AUDIENCE = "your-superset-instance" -``` - -#### Option B: RS256 with static public key - -Use this when you have a fixed RSA key pair (e.g., self-signed tokens): - -```python -# superset_config.py -MCP_AUTH_ENABLED = True -MCP_JWT_ALGORITHM = "RS256" -MCP_JWT_PUBLIC_KEY = """-----BEGIN PUBLIC KEY----- -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA... ------END PUBLIC KEY-----""" -MCP_JWT_ISSUER = "your-issuer" -MCP_JWT_AUDIENCE = "your-audience" -``` - -#### Option C: HS256 with shared secret - -Use this when both the token issuer and the MCP server share a symmetric secret: - -```python -# superset_config.py -MCP_AUTH_ENABLED = True -MCP_JWT_ALGORITHM = "HS256" -MCP_JWT_SECRET = "your-shared-secret-key" -MCP_JWT_ISSUER = "your-issuer" -MCP_JWT_AUDIENCE = "your-audience" -``` - -:::warning -Store `MCP_JWT_SECRET` securely. Never commit it to version control. Use environment variables: -```python -import os -MCP_JWT_SECRET = os.environ.get("MCP_JWT_SECRET") -``` -::: - -#### JWT claims - -The MCP server validates these standard claims: - -| Claim | Config Key | Description | -|-------|-----------|-------------| -| `exp` | -- | Expiration time (always validated) | -| `iss` | `MCP_JWT_ISSUER` | Token issuer (optional but recommended) | -| `aud` | `MCP_JWT_AUDIENCE` | Token audience (optional but recommended) | -| `sub` | -- | Subject -- primary claim used to resolve the Superset user | - -#### User resolution - -After validating the token, the MCP server resolves a Superset username from the claims. It checks these in order, using the first non-empty value: - -1. `subject` -- the standard `sub` claim (via the access token object) -2. `client_id` -- for machine-to-machine tokens -3. `payload["sub"]` -- fallback to raw payload -4. `payload["email"]` -- email-based lookup -5. `payload["username"]` -- explicit username claim - -The resolved value must match a `username` in the Superset `ab_user` table. - -#### Scoped access - -Require specific scopes in the JWT to limit what MCP operations a token can perform: - -```python -# superset_config.py -MCP_REQUIRED_SCOPES = ["mcp:read", "mcp:write"] -``` - -Only tokens that include **all** required scopes are accepted. - -### Custom Auth Provider - -For advanced scenarios (e.g., a proprietary auth system), provide a factory function. This takes precedence over all built-in JWT configuration: - -```python -# superset_config.py -def my_custom_auth_factory(app): - """Return a FastMCP auth provider instance.""" - from fastmcp.server.auth.providers.jwt import JWTVerifier - return JWTVerifier( - jwks_uri="https://my-auth.example.com/.well-known/jwks.json", - issuer="https://my-auth.example.com/", - audience="superset-mcp", - ) - -MCP_AUTH_FACTORY = my_custom_auth_factory -``` - ---- - -## Connecting AI Clients - -### Claude Desktop - -**Local development (no auth):** - -```json -{ - "mcpServers": { - "superset": { - "url": "http://localhost:5008/mcp" - } - } -} -``` - -**With JWT authentication:** - -```json -{ - "mcpServers": { - "superset": { - "command": "npx", - "args": [ - "-y", - "mcp-remote@latest", - "http://your-superset-host:5008/mcp", - "--header", - "Authorization: Bearer YOUR_TOKEN" - ] - } - } -} -``` - -### Claude Code (CLI) - -Add to your project's `.mcp.json`: - -```json -{ - "mcpServers": { - "superset": { - "type": "url", - "url": "http://localhost:5008/mcp" - } - } -} -``` - -With authentication: - -```json -{ - "mcpServers": { - "superset": { - "type": "url", - "url": "http://localhost:5008/mcp", - "headers": { - "Authorization": "Bearer YOUR_TOKEN" - } - } - } -} -``` - -### Claude Web (claude.ai) - -1. Open [claude.ai](https://claude.ai) -2. Click the **+** button (or your profile icon) -3. Select **Connectors** -4. Click **Manage Connectors** > **Add custom connector** -5. Enter a name and your MCP URL (e.g., `https://your-superset-host/mcp`) -6. Click **Add** - -:::info -Custom connectors on Claude Web require a Pro, Max, Team, or Enterprise plan. -::: - -### ChatGPT - -1. Click your profile icon > **Settings** > **Apps and Connectors** -2. Enable **Developer Mode** in Advanced Settings -3. In the chat composer, press **+** > **Add sources** > **App** > **Connect more** > **Create app** -4. Enter a name and your MCP server URL -5. Click **I understand and continue** - -:::info -ChatGPT MCP connectors require a Pro, Team, Enterprise, or Edu plan. -::: - -### Direct HTTP requests - -Call the MCP server directly with any HTTP client: - -```bash -curl -X POST http://localhost:5008/mcp \ - -H 'Content-Type: application/json' \ - -H 'Authorization: Bearer YOUR_JWT_TOKEN' \ - -d '{"jsonrpc": "2.0", "method": "tools/list", "id": 1}' -``` - ---- - -## Deployment - -### Single Process - -The simplest setup: run the MCP server alongside Superset on the same host. - -```mermaid -flowchart TD - subgraph host["Host / VM"] - direction TB - S["Superset
:8088"] --> DB[("Postgres")] - M["MCP Server
:5008"] --> DB - end - C["AI Client"] -- "HTTPS" --> P["Reverse Proxy
(Nginx / Caddy)"] - U["Browser"] -- "HTTPS" --> P - P -- ":8088" --> S - P -- ":5008/mcp" --> M -``` - -**superset_config.py:** - -```python -MCP_SERVICE_HOST = "0.0.0.0" -MCP_SERVICE_PORT = 5008 -MCP_DEV_USERNAME = "admin" # or enable JWT auth - -# If behind a reverse proxy, set the public-facing URL so -# MCP-generated links (chart previews, SQL Lab URLs) resolve correctly: -MCP_SERVICE_URL = "https://superset.example.com" -``` - -**Start both processes:** - -```bash -# Terminal 1 -- Superset web server -superset run -h 0.0.0.0 -p 8088 - -# Terminal 2 -- MCP server -superset mcp run --host 0.0.0.0 --port 5008 -``` - -**Nginx reverse proxy with TLS:** - -```nginx -server { - listen 443 ssl; - server_name superset.example.com; - - ssl_certificate /path/to/cert.pem; - ssl_certificate_key /path/to/key.pem; - - # Superset web UI - location / { - proxy_pass http://127.0.0.1:8088; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - } - - # MCP endpoint - location /mcp { - proxy_pass http://127.0.0.1:5008/mcp; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header Authorization $http_authorization; - } -} -``` - -### Docker Compose - -Run Superset and the MCP server as separate containers sharing the same config: - -```yaml -# docker-compose.yml -services: - superset: - image: apache/superset:latest - ports: - - "8088:8088" - volumes: - - ./superset_config.py:/app/superset_config.py - environment: - - SUPERSET_CONFIG_PATH=/app/superset_config.py - - mcp: - image: apache/superset:latest - command: ["superset", "mcp", "run", "--host", "0.0.0.0", "--port", "5008"] - ports: - - "5008:5008" - volumes: - - ./superset_config.py:/app/superset_config.py - environment: - - SUPERSET_CONFIG_PATH=/app/superset_config.py - depends_on: - - superset -``` - -Both containers share the same `superset_config.py`, so authentication settings, database connections, and feature flags stay in sync. - -### Multi-Pod (Kubernetes) - -For high-availability deployments, configure Redis so that replicas share session state: - -```mermaid -flowchart TD - LB["Load Balancer"] --> M1["MCP Pod 1"] - LB --> M2["MCP Pod 2"] - LB --> M3["MCP Pod 3"] - M1 --> R[("Redis
(session store)")] - M2 --> R - M3 --> R - M1 --> DB[("Postgres")] - M2 --> DB - M3 --> DB -``` - -**superset_config.py:** - -```python -MCP_STORE_CONFIG = { - "enabled": True, - "CACHE_REDIS_URL": "redis://redis-host:6379/0", - "event_store_max_events": 100, - "event_store_ttl": 3600, -} -``` - -When `CACHE_REDIS_URL` is set, the MCP server uses a Redis-backed EventStore for session management, allowing replicas to share state. Without Redis, each pod manages its own in-memory sessions and stateful MCP interactions may fail when requests hit different replicas. - ---- - -## Configuration Reference - -All MCP settings go in `superset_config.py`. Defaults are defined in `superset/mcp_service/mcp_config.py`. - -### Core - -| Setting | Default | Description | -|---------|---------|-------------| -| `MCP_SERVICE_HOST` | `"localhost"` | Host the MCP server binds to | -| `MCP_SERVICE_PORT` | `5008` | Port the MCP server binds to | -| `MCP_SERVICE_URL` | `None` | Public base URL for MCP-generated links (set this when behind a reverse proxy) | -| `MCP_DEBUG` | `False` | Enable debug logging | -| `MCP_DEV_USERNAME` | -- | Superset username for development mode (no auth) | -| `MCP_RBAC_ENABLED` | `True` | Enforce Superset's role-based access control on MCP tool calls. When `True`, each tool checks that the authenticated user has the required FAB permission before executing. Disable only for testing or trusted-network deployments. | - -### Authentication - -| Setting | Default | Description | -|---------|---------|-------------| -| `MCP_AUTH_ENABLED` | `False` | Enable JWT authentication | -| `MCP_JWT_ALGORITHM` | `"RS256"` | JWT signing algorithm (`RS256` or `HS256`) | -| `MCP_JWKS_URI` | `None` | JWKS endpoint URL (RS256) | -| `MCP_JWT_PUBLIC_KEY` | `None` | Static RSA public key string (RS256) | -| `MCP_JWT_SECRET` | `None` | Shared secret string (HS256) | -| `MCP_JWT_ISSUER` | `None` | Expected `iss` claim | -| `MCP_JWT_AUDIENCE` | `None` | Expected `aud` claim | -| `MCP_REQUIRED_SCOPES` | `[]` | Required JWT scopes | -| `MCP_JWT_DEBUG_ERRORS` | `False` | Log detailed JWT errors server-side (never exposed in HTTP responses per RFC 6750) | -| `MCP_AUTH_FACTORY` | `None` | Custom auth provider factory `(flask_app) -> auth_provider`. Takes precedence over built-in JWT | -| `MCP_USER_RESOLVER` | `None` | Custom function `(app, access_token) -> username` to extract a Superset username from a validated JWT token. When `None`, the default resolver checks `preferred_username`, `username`, `email`, and `sub` claims in that order. | - -### Response Size Guard - -Limits response sizes to prevent exceeding LLM context windows: - -```python -MCP_RESPONSE_SIZE_CONFIG = { - "enabled": True, - "token_limit": 25000, - "warn_threshold_pct": 80, - "excluded_tools": [ - "health_check", - "get_chart_preview", - "generate_explore_link", - "open_sql_lab_with_context", - ], -} -``` - -| Key | Default | Description | -|-----|---------|-------------| -| `enabled` | `True` | Enable response size checking | -| `token_limit` | `25000` | Maximum estimated token count per response | -| `warn_threshold_pct` | `80` | Warn when response exceeds this percentage of the limit | -| `excluded_tools` | See above | Tools exempt from size checking (e.g., tools that return URLs, not data) | - -### Caching - -Optional response caching for read-heavy workloads. Requires Redis when used with multiple replicas. - -```python -MCP_CACHE_CONFIG = { - "enabled": False, - "CACHE_KEY_PREFIX": None, - "list_tools_ttl": 300, # 5 min - "list_resources_ttl": 300, - "list_prompts_ttl": 300, - "read_resource_ttl": 3600, # 1 hour - "get_prompt_ttl": 3600, - "call_tool_ttl": 3600, - "max_item_size": 1048576, # 1 MB - "excluded_tools": [ - "execute_sql", - "generate_dashboard", - "generate_chart", - "update_chart", - ], -} -``` - -| Key | Default | Description | -|-----|---------|-------------| -| `enabled` | `False` | Enable response caching | -| `CACHE_KEY_PREFIX` | `None` | Optional prefix for cache keys (useful for shared Redis) | -| `list_tools_ttl` | `300` | Cache TTL in seconds for `tools/list` | -| `list_resources_ttl` | `300` | Cache TTL for `resources/list` | -| `list_prompts_ttl` | `300` | Cache TTL for `prompts/list` | -| `read_resource_ttl` | `3600` | Cache TTL for `resources/read` | -| `get_prompt_ttl` | `3600` | Cache TTL for `prompts/get` | -| `call_tool_ttl` | `3600` | Cache TTL for `tools/call` | -| `max_item_size` | `1048576` | Maximum cached item size in bytes (1 MB) | -| `excluded_tools` | See above | Tools that are never cached (mutating or non-deterministic) | - -### Redis Store (Multi-Pod) - -Enables Redis-backed session and event storage for multi-replica deployments: - -```python -MCP_STORE_CONFIG = { - "enabled": False, - "CACHE_REDIS_URL": None, - "event_store_max_events": 100, - "event_store_ttl": 3600, -} -``` - -| Key | Default | Description | -|-----|---------|-------------| -| `enabled` | `False` | Enable Redis-backed store | -| `CACHE_REDIS_URL` | `None` | Redis connection URL (e.g., `redis://redis-host:6379/0`) | -| `event_store_max_events` | `100` | Maximum events retained per session | -| `event_store_ttl` | `3600` | Event TTL in seconds | - -### Tool Search - -By default the MCP server exposes a lightweight tool-search interface instead of advertising every tool at once. This reduces the initial context sent to the LLM by ~70%, which lowers cost and latency. The AI client discovers tools on demand by calling `search_tools` and then invokes them via `call_tool`. - -```python -MCP_TOOL_SEARCH_CONFIG = { - "enabled": True, - "strategy": "bm25", # "bm25" (natural language) or "regex" - "max_results": 5, - "always_visible": [ # Tools always listed (pinned) - "health_check", - "get_instance_info", - ], - "search_tool_name": "search_tools", - "call_tool_name": "call_tool", - "include_schemas": False, # False=summary mode (name + parameters_hint) - "compact_schemas": True, # Strip $defs (only applies when include_schemas=True) - "max_description_length": 300, -} -``` - -| Key | Default | Description | -|-----|---------|-------------| -| `enabled` | `True` | Enable tool search. When `False`, all tools are listed upfront | -| `strategy` | `"bm25"` | Search ranking algorithm. `"bm25"` supports natural language; `"regex"` supports pattern matching | -| `max_results` | `5` | Maximum tools returned per search query | -| `always_visible` | See above | Tools that always appear in `list_tools`, regardless of search | -| `include_schemas` | `False` | When `False` (default, "summary mode"), search results omit `inputSchema` entirely and include a lightweight `parameters_hint` listing top-level parameter names. Set to `True` to include the full `inputSchema` in search results. Full schemas are always used when a tool is actually invoked via `call_tool`. | -| `compact_schemas` | `True` | Strip `$defs` / `$ref` and replace with `{"type": "object"}` in search results to reduce token cost. Only takes effect when `include_schemas=True` — ignored in summary mode. | -| `max_description_length` | `300` | Truncate tool descriptions in search results (0 = no truncation). Applies in both summary and full-schema modes. | - -:::tip -Set `enabled: False` to revert to the traditional "show all tools at once" behavior, which some clients or workflows may prefer. -::: - -Tool search reduces the initial token cost from ~15–20K tokens (full catalog) down to ~4–5K tokens (pinned tools + search interface) — roughly 85% savings at the start of each conversation. - -### Session & CSRF - -These values are flat-merged into the Flask app config used by the MCP server process: - -```python -MCP_SESSION_CONFIG = { - "SESSION_COOKIE_HTTPONLY": True, - "SESSION_COOKIE_SECURE": False, - "SESSION_COOKIE_SAMESITE": "Lax", - "SESSION_COOKIE_NAME": "superset_session", - "PERMANENT_SESSION_LIFETIME": 86400, -} - -MCP_CSRF_CONFIG = { - "WTF_CSRF_ENABLED": True, - "WTF_CSRF_TIME_LIMIT": None, -} -``` - ---- - -## Access Control - -### RBAC Enforcement - -The MCP server respects Superset's full role-based access control (RBAC). Every authenticated user can only access the data and operations their Superset roles permit — the same rules that apply in the Superset UI apply through MCP. - -Each tool declares one or more required FAB permissions. The table below maps tool groups to their permission requirements: - -| Tool group | Required FAB permission | -|------------|------------------------| -| `list_charts`, `get_chart_info`, `get_chart_data`, `get_chart_preview`, `generate_chart`, `update_chart` | `can_read` on `Chart` (read), `can_write` on `Chart` (mutate) | -| `list_dashboards`, `get_dashboard_info`, `generate_dashboard`, `add_chart_to_existing_dashboard` | `can_read` on `Dashboard` (read), `can_write` on `Dashboard` (mutate) | -| `list_datasets`, `get_dataset_info`, `create_virtual_dataset` | `can_read` on `Dataset` (read), `can_write` on `Dataset` (mutate) | -| `list_databases`, `get_database_info` | `can_read` on `Database` | -| `execute_sql` | `can_execute_sql_query` on `SQLLab` | -| `open_sql_lab_with_context` | `can_read` on `SQLLab` | -| `save_sql_query` | `can_write` on `SavedQuery` | -| `health_check` | None (public) | - -To disable RBAC checking globally (for trusted-network deployments or testing), set: - -```python -# superset_config.py -MCP_RBAC_ENABLED = False -``` - -:::warning -Disabling RBAC removes all permission checks from MCP tool calls. Only do this on isolated, internal deployments where all MCP users are trusted admins. -::: - -### Audit Log - -All MCP tool calls are recorded in Superset's action log. You can view them at **Settings → Action Log** (admin only). Each log entry records: - -- The tool name (e.g., `mcp.generate_chart.db_write`) -- The authenticated user -- A timestamp - -This makes MCP activity fully auditable alongside regular Superset activity. The action log uses the same event logger as the rest of Superset, so existing log ingestion pipelines (e.g., sending logs to Elasticsearch or a SIEM) capture MCP events automatically. - -### Middleware Pipeline - -Every MCP request passes through a middleware stack before reaching the tool function. The default stack (assembled in `build_middleware_list()` in `server.py`) is: - -| Middleware | Purpose | Default | -|------------|---------|---------| -| `StructuredContentStripperMiddleware` | Strips `structuredContent` from responses for Claude.ai bridge compatibility | Enabled | -| `LoggingMiddleware` | Logs each tool call with user, parameters, and duration | Enabled | -| `GlobalErrorHandlerMiddleware` | Catches unhandled exceptions and sanitizes sensitive data before it reaches the client | Enabled | -| `ResponseSizeGuardMiddleware` | Estimates token count, warns at 80% of limit, blocks at limit | Enabled (configurable via `MCP_RESPONSE_SIZE_CONFIG`) | -| `ResponseCachingMiddleware` | Caches read-heavy tool responses (in-memory or Redis) | Disabled (enable via `MCP_CACHE_CONFIG`) | - -Additional middleware classes (`RateLimitMiddleware`, `FieldPermissionsMiddleware`, `PrivateToolMiddleware`) are implemented in `superset/mcp_service/middleware.py` but are not added to the default pipeline. They are available for operators who want to layer them in via a custom startup path. - -### Error Sanitization - -The `GlobalErrorHandlerMiddleware` automatically redacts sensitive information from all error messages before they reach the LLM client. The following are replaced with generic messages: - -- **Database connection strings** — replaced with a generic connection error message -- **API keys and tokens** — redacted from error traces -- **File system paths** — stripped to prevent information disclosure -- **IP addresses** — removed from error context - -This ensures that a misconfigured database connection or an unexpected exception never leaks credentials or internal topology to the LLM or its users. All regex patterns used for redaction are bounded to prevent ReDoS attacks. - ---- - -## Performance - -### Connection Pooling - -Each MCP server process maintains its own SQLAlchemy connection pool to the database. For multi-worker deployments, total open connections = **workers × pool size**. - -```python -# superset_config.py -SQLALCHEMY_POOL_SIZE = 5 -SQLALCHEMY_MAX_OVERFLOW = 10 -SQLALCHEMY_POOL_TIMEOUT = 30 -SQLALCHEMY_POOL_RECYCLE = 3600 # Recycle connections after 1 hour -``` - -For a 3-pod Kubernetes deployment with the defaults above, expect up to 3 × (5 + 10) = 45 connections. Size your database's `max_connections` accordingly. - -### Response Caching - -Enable response caching for read-heavy workloads (dashboards/datasets that don't change frequently). With the in-memory backend (default when `MCP_STORE_CONFIG` is disabled), caching is per-process. Use Redis-backed caching for consistent cache hits across multiple pods: - -```python -MCP_CACHE_CONFIG = {"enabled": True, "call_tool_ttl": 3600} -MCP_STORE_CONFIG = {"enabled": True, "CACHE_REDIS_URL": "redis://redis:6379/0"} -``` - -Mutating tools (`generate_chart`, `update_chart`, `execute_sql`, `generate_dashboard`) are always excluded from caching regardless of this setting. - ---- - -## Troubleshooting - -### Server won't start - -- Verify `fastmcp` is installed: `pip install fastmcp` -- Check that `MCP_DEV_USERNAME` is set if auth is disabled -- the server requires a user identity -- Confirm the port is not already in use: `lsof -i :5008` - -### 401 Unauthorized - -- Verify your JWT token has not expired (`exp` claim) -- Check that `MCP_JWT_ISSUER` and `MCP_JWT_AUDIENCE` match the token's `iss` and `aud` claims exactly -- For RS256 with JWKS: confirm the JWKS URI is reachable from the MCP server -- For RS256 with static key: confirm the public key string includes the `BEGIN`/`END` markers -- For HS256: confirm the secret matches between the token issuer and `MCP_JWT_SECRET` -- Enable `MCP_JWT_DEBUG_ERRORS = True` for detailed server-side logging (errors are never leaked to the client) - -### Tool not found - -- Ensure the MCP server and Superset share the same `superset_config.py` -- Check server logs at startup -- tool registration errors are logged with the tool name and reason - -### Client can't connect - -- Verify the MCP server URL is reachable from the client machine -- For Claude Desktop: fully quit the app (not just close the window) and restart after config changes -- For remote access: ensure your firewall and reverse proxy allow traffic to the MCP port -- Confirm the URL path ends with `/mcp` (e.g., `http://localhost:5008/mcp`) - -### Permission errors on tool calls - -- The MCP server enforces Superset's RBAC permissions -- the authenticated user must have the required roles -- In development mode, ensure `MCP_DEV_USERNAME` maps to a user with appropriate roles (e.g., Admin) -- Check `superset/security/manager.py` for the specific permission tuples required by each tool domain (e.g., `("can_execute_sql_query", "SQLLab")`) - -### Response too large - -- If a tool call returns an error about exceeding token limits, the response size guard is blocking an oversized result -- Reduce `page_size` or `limit` parameters, use `select_columns` to exclude large fields, or add filters to narrow results -- To adjust the threshold, change `token_limit` in `MCP_RESPONSE_SIZE_CONFIG` -- To disable the guard entirely, set `MCP_RESPONSE_SIZE_CONFIG = {"enabled": False}` - ---- - -## Audit Events - -All MCP tool calls are logged to Superset's event logger, the same system used by the web UI (viewable at **Settings → Action Log**). Each event captures: - -- **Action**: `mcp.
![]({useBaseUrl("/img/docker-compose.webp")
-- -:::caution -Since `docker compose` is primarily designed to run a set of containers on **a single host** -and can't support requirements for **high availability**, we do not support nor recommend -using our `docker compose` constructs to support production-type use-cases. For single host -environments, we recommend using [minikube](https://minikube.sigs.k8s.io/docs/start/) along -with our [installing on k8s](https://superset.apache.org/admin-docs/installation/running-on-kubernetes) -documentation. -::: - -As mentioned in our [quickstart guide](/user-docs/quickstart), the fastest way to try -Superset locally is using Docker Compose on a Linux or Mac OSX -computer. Superset does not have official support for Windows. It's also the easiest -way to launch a fully functioning **development environment** quickly. - -Note that there are 4 major ways we support to run `docker compose`: - -1. **docker-compose.yml:** for interactive development, where we mount your local folder with the - frontend/backend files that you can edit and experience the changes you - make in the app in real time -1. **docker-compose-light.yml:** a lightweight configuration with minimal services (database, - Superset app, and frontend dev server) for development. Uses in-memory caching instead of Redis - and is designed for running multiple instances simultaneously -1. **docker-compose-non-dev.yml** where we just build a more immutable image based on the - local branch and get all the required images running. Changes in the local branch - at the time you fire this up will be reflected, but changes to the code - while `up` won't be reflected in the app -1. **docker-compose-image-tag.yml** where we fetch an image from docker-hub say for the - `5.0.0` release for instance, and fire it up so you can try it. Here what's in - the local branch has no effects on what's running, we just fetch and run - pre-built images from docker-hub. For `docker compose` to work along with the - Postgres image it boots up, you'll want to point to a `-dev`-suffixed TAG, as in - `export TAG=5.0.0-dev` or `export TAG=4.1.2-dev`, with `latest-dev` being the default. - The `dev` builds include the `psycopg2-binary` required to connect - to the Postgres database launched as part of the `docker compose` builds. - -More on these approaches after setting up the requirements for either. - -## Requirements - -Note that this documentation assumes that you have [Docker](https://www.docker.com) and -[git](https://git-scm.com/) installed. Note also that we used to use `docker-compose` but that -is on the path to deprecation so we now use `docker compose` instead. - -## 1. Clone Superset's GitHub repository - -[Clone Superset's repo](https://github.com/apache/superset) in your terminal with the -following command: - -```bash -git clone --depth=1 https://github.com/apache/superset.git -``` - -Once that command completes successfully, you should see a new `superset` folder in your -current directory. - -## 2. Launch Superset Through Docker Compose - -First let's assume you're familiar with `docker compose` mechanics. Here we'll refer generally -to `docker compose up` even though in some cases you may want to force a check for newer remote -images using `docker compose pull`, force a build with `docker compose build` or force a build -on latest base images using `docker compose build --pull`. In most cases though, the simple -`up` command should do just fine. Refer to docker compose docs for more information on the topic. - -### Option #1 - for an interactive development environment - -```bash -# The --build argument insures all the layers are up-to-date -docker compose up --build -``` - -:::tip -When running in development mode the `superset-node` -container needs to finish building assets in order for the UI to render properly. If you would just -like to try out Superset without making any code changes follow the steps documented for -`production` or a specific version below. -::: - -:::tip -By default, we mount the local superset-frontend folder here and run `npm install` as well -as `npm run dev` which triggers webpack to compile/bundle the frontend code. Depending -on your local setup, especially if you have less than 16GB of memory, it may be very slow to -perform those operations. In this case, we recommend you set the env var -`BUILD_SUPERSET_FRONTEND_IN_DOCKER` to `false`, and to run this locally instead in a terminal. -Simply trigger `npm i && npm run dev`, this should be MUCH faster. -::: - -:::tip -Sometimes, your npm-related state can get out-of-wack, running `npm run prune` from -the `superset-frontend/` folder will nuke the various' packages `node_module/` folders -and help you start fresh. In the context of `docker compose` setting -`export NPM_RUN_PRUNE=true` prior to running `docker compose up` will trigger that -from within docker. This will slow down the startup, but will fix various npm-related issues. -::: - -### Option #2 - lightweight development with multiple instances - -For a lighter development setup that uses fewer resources and supports running multiple instances: - -```bash -# Single lightweight instance (default port 9001) -docker compose -f docker-compose-light.yml up - -# Multiple instances with different ports -NODE_PORT=9001 docker compose -p superset-1 -f docker-compose-light.yml up -NODE_PORT=9002 docker compose -p superset-2 -f docker-compose-light.yml up -NODE_PORT=9003 docker compose -p superset-3 -f docker-compose-light.yml up -``` - -This configuration includes: -- PostgreSQL database (internal network only) -- Superset application server -- Frontend development server with webpack hot reloading -- In-memory caching (no Redis) -- Isolated volumes and networks per instance - -Access each instance at `http://localhost:{NODE_PORT}` (e.g., `http://localhost:9001`). - -### Option #3 - build a set of immutable images from the local branch - -```bash -docker compose -f docker-compose-non-dev.yml up -``` - -### Option #4 - boot up an official release - -```bash -# Set the version you want to run -export TAG=5.0.0 -# Fetch the tag you're about to check out (assuming you shallow-cloned the repo) -git fetch --depth=1 origin tag $TAG -# Could also fetch all tags too if you've got bandwidth to spare -# git fetch --tags -# Checkout the corresponding git ref -git checkout $TAG -# Fire up docker compose -docker compose -f docker-compose-image-tag.yml up -``` - -Here various release tags, github SHA, and latest `master` can be referenced by the TAG env var. -Refer to the docker-related documentation to learn more about existing tags you can point to -from Docker Hub. - -:::note -For option #2 and #3, we recommend checking out the release tag from the git repository -(ie: `git checkout 5.0.0`) for more guaranteed results. This ensures that the `docker-compose.*.yml` -configurations and that the mounted `docker/` scripts are in sync with the image you are -looking to fire up. -::: - -## `docker compose` tips & configuration - -:::caution -All of the content belonging to a Superset instance - charts, dashboards, users, etc. - is stored in -its metadata database. In production, this database should be backed up. The default installation -with docker compose will store that data in a PostgreSQL database contained in a Docker -[volume](https://docs.docker.com/storage/volumes/), which is not backed up. - -Again, **THE DOCKER-COMPOSE INSTALLATION IS NOT PRODUCTION-READY OUT OF THE BOX.** - -::: - -You should see a stream of logging output from the containers being launched on your machine. Once -this output slows, you should have a running instance of Superset on your local machine! To avoid -the wall of text on future runs, add the `-d` option to the end of the `docker compose up` command. - -### Configuring Further - -The following is for users who want to configure how Superset runs in Docker Compose; otherwise, you -can skip to the next section. - -You can install additional python packages and apply config overrides by following the steps -mentioned in [docker/README.md](https://github.com/apache/superset/tree/master/docker#configuration) - -Note that `docker/.env` sets the default environment variables for all the docker images -used by `docker compose`, and that `docker/.env-local` can be used to override those defaults. -Also note that `docker/.env-local` is referenced in our `.gitignore`, -preventing developers from risking committing potentially sensitive configuration to the repository. - -One important variable is `SUPERSET_LOAD_EXAMPLES` which determines whether the `superset_init` -container will populate example data and visualizations into the metadata database. These examples -are helpful for learning and testing out Superset but unnecessary for experienced users and -production deployments. The loading process can sometimes take a few minutes and a good amount of -CPU, so you may want to disable it on a resource-constrained device. - -For more advanced or dynamic configurations that are typically managed in a `superset_config.py` file -located in your `PYTHONPATH`, note that it can be done by providing a -`docker/pythonpath_dev/superset_config_docker.py` that will be ignored by git -(preventing you to commit/push your local configuration back to the repository). -The mechanics of this are in `docker/pythonpath_dev/superset_config.py` where you can see -that the logic runs a `from superset_config_docker import *` - -:::note -Users often want to connect to other databases from Superset. Currently, the easiest way to -do this is to modify the `docker-compose-non-dev.yml` file and add your database as a service that -the other services depend on (via `x-superset-depends-on`). Others have attempted to set -`network_mode: host` on the Superset services, but these generally break the installation, -because the configuration requires use of the Docker Compose DNS resolver for the service names. -If you have a good solution for this, let us know! -::: - -:::note -Superset uses [Scarf Gateway](https://about.scarf.sh/scarf-gateway) to collect telemetry -data. Knowing the installation counts for different Superset versions informs the project's -decisions about patching and long-term support. Scarf purges personally identifiable information -(PII) and provides only aggregated statistics. - -To opt-out of this data collection for packages downloaded through the Scarf Gateway by your docker -compose based installation, edit the `x-superset-image:` line in your `docker-compose.yml` and -`docker-compose-non-dev.yml` files, replacing `apachesuperset.docker.scarf.sh/apache/superset` with -`apache/superset` to pull the image directly from Docker Hub. - -To disable the Scarf telemetry pixel, set the `SCARF_ANALYTICS` environment variable to `False` in -your terminal and/or in your `docker/.env` file. -::: - -## 3. Log in to Superset - -Your local Superset instance also includes a Postgres server to store your data and is already -pre-loaded with some example datasets that ship with Superset. You can access Superset now via your -web browser by visiting `http://localhost:8088`. Note that many browsers now default to `https` - if -yours is one of them, please make sure it uses `http`. - -Log in with the default username and password: - -```bash -username: admin -``` - -```bash -password: admin -``` - -## 4. Connecting Superset to your local database instance - -When running Superset using `docker` or `docker compose` it runs in its own docker container, as if -the Superset was running in a separate machine entirely. Therefore attempts to connect to your local -database with the hostname `localhost` won't work as `localhost` refers to the docker container -Superset is running in, and not your actual host machine. Fortunately, docker provides an easy way -to access network resources in the host machine from inside a container, and we will leverage this -capability to connect to our local database instance. - -Here the instructions are for connecting to postgresql (which is running on your host machine) from -Superset (which is running in its docker container). Other databases may have slightly different -configurations but gist would be same and boils down to 2 steps - - -1. **(Mac users may skip this step)** Configuring the local postgresql/database instance to accept -public incoming connections. By default, postgresql only allows incoming connections from -`localhost` and under Docker, unless you use `--network=host`, `localhost` will refer to different -endpoints on the host machine and in a docker container respectively. Allowing postgresql to accept -connections from the Docker involves making one-line changes to the files `postgresql.conf` and -`pg_hba.conf`; you can find helpful links tailored to your OS / PG version on the web easily for -this task. For Docker it suffices to only whitelist IPs `172.0.0.0/8` instead of `*`, but in any -case you are _warned_ that doing this in a production database _may_ have disastrous consequences as -you are opening your database to the public internet. -1. Instead of `localhost`, try using `host.docker.internal` (Mac users, Ubuntu) or `172.18.0.1` -(Linux users) as the hostname when attempting to connect to the database. This is a Docker internal -detail -- what is happening is that, in Mac systems, Docker Desktop creates a dns entry for the -hostname `host.docker.internal` which resolves to the correct address for the host machine, whereas -in Linux this is not the case (at least by default). If neither of these 2 hostnames work then you -may want to find the exact hostname you want to use, for that you can do `ifconfig` or -`ip addr show` and look at the IP address of `docker0` interface that must have been created by -Docker for you. Alternately if you don't even see the `docker0` interface try (if needed with sudo) -`docker network inspect bridge` and see if there is an entry for `"Gateway"` and note the IP -address. - -## 4. To build or not to build - -When running `docker compose up`, docker will build what is required behind the scene, but -may use the docker cache if assets already exist. Running `docker compose build` prior to -`docker compose up` or the equivalent shortcut `docker compose up --build` ensures that your -docker images match the definition in the repository. This should only apply to the main -docker-compose.yml file (default) and not to the alternative methods defined above. diff --git a/docs/admin_docs/installation/installation-methods.mdx b/docs/admin_docs/installation/installation-methods.mdx deleted file mode 100644 index 0e8f11b7d57..00000000000 --- a/docs/admin_docs/installation/installation-methods.mdx +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Installation Methods -hide_title: true -sidebar_position: 2 -version: 1 ---- - -import useBaseUrl from "@docusaurus/useBaseUrl"; - -# Installation Methods - -How should you install Superset? Here's a comparison of the different options. It will help if you've first read the [Architecture](/admin-docs/installation/architecture) page to understand Superset's different components. - -The fundamental trade-off is between you needing to do more of the detail work yourself vs. using a more complex deployment route that handles those details. - -## [Docker Compose](/admin-docs/installation/docker-compose) - -**Summary:** This takes advantage of containerization while remaining simpler than Kubernetes. This is the best way to try out Superset; it's also useful for developing & contributing back to Superset. - -If you're not just demoing the software, you'll need a moderate understanding of Docker to customize your deployment and avoid a few risks. Even when fully-optimized this is not as robust a method as Kubernetes when it comes to large-scale production deployments. - -You manage a superset-config.py file and a docker-compose.yml file. Docker Compose brings up all the needed services - the Superset application, a Postgres metadata DB, Redis cache, Celery worker and beat. They are automatically connected to each other. - -**Responsibilities** - -You will need to back up your metadata DB. That could mean backing up the service running as a Docker container and its volume; ideally you are running Postgres as a service outside of that container and backing up that service. - -You will also need to extend the Superset docker image. The default `lean` images do not contain drivers needed to access your metadata database (Postgres or MySQL), nor to access your data warehouse, nor the headless browser needed for Alerts & Reports. You could run a `-dev` image while demoing Superset, which has some of this, but you'll still need to install the driver for your data warehouse. The `-dev` images run as root, which is not recommended for production. - -Ideally you will build your own image of Superset that extends `lean`, adding what your deployment needs. See [Building your own production Docker image](/admin-docs/installation/docker-builds/#building-your-own-production-docker-image). - -## [Kubernetes (K8s)](/admin-docs/installation/kubernetes) - -**Summary:** This is the best-practice way to deploy a production instance of Superset, but has the steepest skill requirement - someone who knows Kubernetes. - -You will deploy Superset into a K8s cluster. The most common method is using the community-maintained Helm chart, though work is now underway to implement [SIP-149 - a Kubernetes Operator for Superset](https://github.com/apache/superset/issues/31408). - -A K8s deployment can scale up and down based on usage and deploy rolling updates with zero downtime - features that big deployments appreciate. - -**Responsibilities** - -You will need to build your own Docker image, and back up your metadata DB, both as described in Docker Compose above. You'll also need to customize your Helm chart values and deploy and maintain your Kubernetes cluster. - -## [PyPI (Python)](/admin-docs/installation/pypi) - -**Summary:** This is the only method that requires no knowledge of containers. It requires the most hands-on work to deploy, connect, and maintain each component. - -You install Superset as a Python package and run it that way, providing your own metadata database. Superset has documentation on how to install this way, but it is updated infrequently. - -If you want caching, you'll set up Redis or RabbitMQ. If you want Alerts & Reports, you'll set up Celery. - -**Responsibilities** - -You will need to get the component services running and communicating with each other. You'll need to arrange backups of your metadata database. - -When upgrading, you'll need to manage the system environment and packages and ensure all components have functional dependencies. diff --git a/docs/admin_docs/installation/kubernetes.mdx b/docs/admin_docs/installation/kubernetes.mdx deleted file mode 100644 index c18bf803f92..00000000000 --- a/docs/admin_docs/installation/kubernetes.mdx +++ /dev/null @@ -1,451 +0,0 @@ ---- -title: Kubernetes -hide_title: true -sidebar_position: 3 -version: 1 ---- - -import useBaseUrl from "@docusaurus/useBaseUrl"; - -# Installing on Kubernetes - -
![]({useBaseUrl("/img/k8s.png")
-- -Running Superset on Kubernetes is supported with the provided [Helm](https://helm.sh/) chart -found in the official [Superset helm repository](https://apache.github.io/superset/index.yaml). - -## Prerequisites - -- A Kubernetes cluster -- Helm installed - -:::note -For simpler, single host environments, we recommend using -[minikube](https://minikube.sigs.k8s.io/docs/start/) which is easy to setup on many platforms -and works fantastically well with the Helm chart referenced here. -::: - -## Running - -1. Add the Superset helm repository - -```sh -helm repo add superset https://apache.github.io/superset -"superset" has been added to your repositories -``` - -2. View charts in repo - -```sh -helm search repo superset -NAME CHART VERSION APP VERSION DESCRIPTION -superset/superset 0.1.1 1.0 Apache Superset is a modern, enterprise-ready b... -``` - -3. Configure your setting overrides - -Just like any typical Helm chart, you'll need to craft a `values.yaml` file that would define/override any of the values exposed into the default [values.yaml](https://github.com/apache/superset/tree/master/helm/superset/values.yaml), or from any of the dependent charts it depends on: - -- [bitnami/redis](https://artifacthub.io/packages/helm/bitnami/redis) -- [bitnami/postgresql](https://artifacthub.io/packages/helm/bitnami/postgresql) - -More info down below on some important overrides you might need. - -4. Install and run - -```sh -helm upgrade --install --values my-values.yaml superset superset/superset -``` - -You should see various pods popping up, such as: - -```sh -kubectl get pods -NAME READY STATUS RESTARTS AGE -superset-celerybeat-7cdcc9575f-k6xmc 1/1 Running 0 119s -superset-f5c9c667-dw9lp 1/1 Running 0 4m7s -superset-f5c9c667-fk8bk 1/1 Running 0 4m11s -superset-init-db-zlm9z 0/1 Completed 0 111s -superset-postgresql-0 1/1 Running 0 6d20h -superset-redis-master-0 1/1 Running 0 6d20h -superset-worker-75b48bbcc-jmmjr 1/1 Running 0 4m8s -superset-worker-75b48bbcc-qrq49 1/1 Running 0 4m12s -``` - -The exact list will depend on some of your specific configuration overrides but you should generally expect: - -- N `superset-xxxx-yyyy` and `superset-worker-xxxx-yyyy` pods (depending on your `supersetNode.replicaCount` and `supersetWorker.replicaCount` values) -- 1 `superset-postgresql-0` depending on your postgres settings -- 1 `superset-redis-master-0` depending on your redis settings -- 1 `superset-celerybeat-xxxx-yyyy` pod if you have `supersetCeleryBeat.enabled = true` in your values overrides - -1. Access it - -The chart will publish appropriate services to expose the Superset UI internally within your k8s cluster. To access it externally you will have to either: - -- Configure the Service as a `LoadBalancer` or `NodePort` -- Set up an `Ingress` for it - the chart includes a definition, but will need to be tuned to your needs (hostname, tls, annotations etc...) -- Run `kubectl port-forward superset-xxxx-yyyy :8088` to directly tunnel one pod's port into your localhost - -Depending how you configured external access, the URL will vary. Once you've identified the appropriate URL you can log in with: - -- user: `admin` -- password: `admin` - -## Important settings - -### Security settings - -Default security settings and passwords are included but you **MUST** update them to run `prod` instances, in particular: - -```yaml -postgresql: - postgresqlPassword: superset -``` - -Make sure, you set a unique strong complex alphanumeric string for your SECRET_KEY and use a tool to help you generate -a sufficiently random sequence. - -- To generate a good key you can run, `openssl rand -base64 42` - -```yaml -configOverrides: - secret: | - SECRET_KEY = 'YOUR_OWN_RANDOM_GENERATED_SECRET_KEY' -``` - -If you want to change the previous secret key then you should rotate the keys. -Default secret key for kubernetes deployment is `thisISaSECRET_1234` - -```yaml -configOverrides: - my_override: | - PREVIOUS_SECRET_KEY = 'YOUR_PREVIOUS_SECRET_KEY' - SECRET_KEY = 'YOUR_OWN_RANDOM_GENERATED_SECRET_KEY' -init: - command: - - /bin/sh - - -c - - | - . {{ .Values.configMountPath }}/superset_bootstrap.sh - superset re-encrypt-secrets - . {{ .Values.configMountPath }}/superset_init.sh -``` - -:::note -Superset uses [Scarf Gateway](https://about.scarf.sh/scarf-gateway) to collect telemetry data. Knowing the installation counts for different Superset versions informs the project's decisions about patching and long-term support. Scarf purges personally identifiable information (PII) and provides only aggregated statistics. - -To opt-out of this data collection in your Helm-based installation, edit the `repository:` line in your `helm/superset/values.yaml` file, replacing `apachesuperset.docker.scarf.sh/apache/superset` with `apache/superset` to pull the image directly from Docker Hub. -::: - -### Dependencies - -Install additional packages and do any other bootstrap configuration in the bootstrap script. -For production clusters it's recommended to build own image with this step done in CI. - -:::note - -Superset requires a Python DB-API database driver and a SQLAlchemy -dialect to be installed for each datastore you want to connect to. - -See [Install Database Drivers](/user-docs/databases#installing-database-drivers) for more information. -It is recommended that you refer to versions listed in -[pyproject.toml](https://github.com/apache/superset/blob/master/pyproject.toml) -instead of hard-coding them in your bootstrap script, as seen below. - -::: - -The following example installs the drivers for BigQuery and Elasticsearch, allowing you to connect to these data sources within your Superset setup: - -```yaml -bootstrapScript: | - #!/bin/bash - uv pip install .[postgres] \ - .[bigquery] \ - .[elasticsearch] &&\ - if [ ! -f ~/bootstrap ]; then echo "Running Superset with uid {{ .Values.runAsUser }}" > ~/bootstrap; fi -``` - -### superset_config.py - -The default `superset_config.py` is fairly minimal and you will very likely need to extend it. This is done by specifying one or more key/value entries in `configOverrides`, e.g.: - -```yaml -configOverrides: - my_override: | - # This will make sure the redirect_uri is properly computed, even with SSL offloading - ENABLE_PROXY_FIX = True - FEATURE_FLAGS = { - "DYNAMIC_PLUGINS": True - } -``` - -Those will be evaluated as Helm templates and therefore will be able to reference other `values.yaml` variables e.g. `{{ .Values.ingress.hosts[0] }}` will resolve to your ingress external domain. - -The entire `superset_config.py` will be installed as a secret, so it is safe to pass sensitive parameters directly... however it might be more readable to use secret env variables for that. - -Full python files can be provided by running `helm upgrade --install --values my-values.yaml --set-file configOverrides.oauth=set_oauth.py` - -### Environment Variables - -Those can be passed as key/values either with `extraEnv` or `extraSecretEnv` if they're sensitive. They can then be referenced from `superset_config.py` using e.g. `os.environ.get("VAR")`. - -```yaml -extraEnv: - SMTP_HOST: smtp.gmail.com - SMTP_USER: user@gmail.com - SMTP_PORT: "587" - SMTP_MAIL_FROM: user@gmail.com - -extraSecretEnv: - SMTP_PASSWORD: xxxx - -configOverrides: - smtp: | - import ast - SMTP_HOST = os.getenv("SMTP_HOST","localhost") - SMTP_STARTTLS = ast.literal_eval(os.getenv("SMTP_STARTTLS", "True")) - SMTP_SSL = ast.literal_eval(os.getenv("SMTP_SSL", "False")) - SMTP_USER = os.getenv("SMTP_USER","superset") - SMTP_PORT = os.getenv("SMTP_PORT",25) - SMTP_PASSWORD = os.getenv("SMTP_PASSWORD","superset") -``` - -### System packages - -If new system packages are required, they can be installed before application startup by overriding the container's `command`, e.g.: - -```yaml -supersetWorker: - command: - - /bin/sh - - -c - - | - apt update - apt install -y somepackage - apt autoremove -yqq --purge - apt clean - - # Run celery worker - . {{ .Values.configMountPath }}/superset_bootstrap.sh; celery --app=superset.tasks.celery_app:app worker -``` - -### Data sources - -Data source definitions can be automatically declared by providing key/value yaml definitions in `extraConfigs`: - -```yaml -extraConfigs: - import_datasources.yaml: | - databases: - - allow_file_upload: true - allow_ctas: true - allow_cvas: true - database_name: example-db - extra: "{\r\n \"metadata_params\": {},\r\n \"engine_params\": {},\r\n \"\ - metadata_cache_timeout\": {},\r\n \"schemas_allowed_for_file_upload\": []\r\n\ - }" - sqlalchemy_uri: example://example-db.local - tables: [] -``` - -Those will also be mounted as secrets and can include sensitive parameters. - -## Configuration Examples - -### Setting up OAuth - -:::note - -OAuth setup requires that the [authlib](https://authlib.org/) Python library is installed. This can -be done using `pip` by updating the `bootstrapScript`. See the [Dependencies](#dependencies) section -for more information. - -::: - -```yaml -extraEnv: - AUTH_DOMAIN: example.com - -extraSecretEnv: - GOOGLE_KEY: xxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com - GOOGLE_SECRET: xxxxxxxxxxxxxxxxxxxxxxxx - -configOverrides: - enable_oauth: | - # This will make sure the redirect_uri is properly computed, even with SSL offloading - ENABLE_PROXY_FIX = True - - from flask_appbuilder.security.manager import AUTH_OAUTH - AUTH_TYPE = AUTH_OAUTH - OAUTH_PROVIDERS = [ - { - "name": "google", - "icon": "fa-google", - "token_key": "access_token", - "remote_app": { - "client_id": os.getenv("GOOGLE_KEY"), - "client_secret": os.getenv("GOOGLE_SECRET"), - "api_base_url": "https://www.googleapis.com/oauth2/v2/", - "client_kwargs": {"scope": "email profile"}, - "request_token_url": None, - "access_token_url": "https://accounts.google.com/o/oauth2/token", - "authorize_url": "https://accounts.google.com/o/oauth2/auth", - "authorize_params": {"hd": os.getenv("AUTH_DOMAIN", "")} - }, - } - ] - - # Map Authlib roles to superset roles - AUTH_ROLE_ADMIN = 'Admin' - AUTH_ROLE_PUBLIC = 'Public' - - # Will allow user self registration, allowing to create Flask users from Authorized User - AUTH_USER_REGISTRATION = True - - # The default user self registration role - AUTH_USER_REGISTRATION_ROLE = "Admin" -``` - -### Enable Alerts and Reports - -For this, as per the [Alerts and Reports doc](/admin-docs/configuration/alerts-reports), you will need to: - -#### Install a supported webdriver in the Celery worker - -This is done either by using a custom image that has the webdriver pre-installed, or installing at startup time by overriding the `command`. Here's a working example for `chromedriver`: - -```yaml -supersetWorker: - command: - - /bin/sh - - -c - - | - # Install chrome webdriver - # See https://github.com/apache/superset/blob/4fa3b6c7185629b87c27fc2c0e5435d458f7b73d/docs/src/pages/admin-docs/installation/email_reports.mdx - apt-get update - apt-get install -y wget - wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb - apt-get install -y --no-install-recommends ./google-chrome-stable_current_amd64.deb - wget https://chromedriver.storage.googleapis.com/88.0.4324.96/chromedriver_linux64.zip - apt-get install -y zip - unzip chromedriver_linux64.zip - chmod +x chromedriver - mv chromedriver /usr/bin - apt-get autoremove -yqq --purge - apt-get clean - rm -f google-chrome-stable_current_amd64.deb chromedriver_linux64.zip - - # Run - . {{ .Values.configMountPath }}/superset_bootstrap.sh; celery --app=superset.tasks.celery_app:app worker -``` - -#### Run the Celery beat - -This pod will trigger the scheduled tasks configured in the alerts and reports UI section: - -```yaml -supersetCeleryBeat: - enabled: true -``` - -#### Configure the appropriate Celery jobs and SMTP/Slack settings - -```yaml -extraEnv: - SMTP_HOST: smtp.gmail.com - SMTP_USER: user@gmail.com - SMTP_PORT: "587" - SMTP_MAIL_FROM: user@gmail.com - -extraSecretEnv: - SLACK_API_TOKEN: xoxb-xxxx-yyyy - SMTP_PASSWORD: xxxx-yyyy - -configOverrides: - feature_flags: | - import ast - - FEATURE_FLAGS = { - "ALERT_REPORTS": True - } - - SMTP_HOST = os.getenv("SMTP_HOST","localhost") - SMTP_STARTTLS = ast.literal_eval(os.getenv("SMTP_STARTTLS", "True")) - SMTP_SSL = ast.literal_eval(os.getenv("SMTP_SSL", "False")) - SMTP_USER = os.getenv("SMTP_USER","superset") - SMTP_PORT = os.getenv("SMTP_PORT",25) - SMTP_PASSWORD = os.getenv("SMTP_PASSWORD","superset") - SMTP_MAIL_FROM = os.getenv("SMTP_MAIL_FROM","superset@superset.com") - - SLACK_API_TOKEN = os.getenv("SLACK_API_TOKEN",None) - celery_conf: | - from celery.schedules import crontab - - class CeleryConfig: - broker_url = f"redis://{env('REDIS_HOST')}:{env('REDIS_PORT')}/0" - imports = ( - "superset.sql_lab", - "superset.tasks.cache", - "superset.tasks.scheduler", - ) - result_backend = f"redis://{env('REDIS_HOST')}:{env('REDIS_PORT')}/0" - task_annotations = { - "sql_lab.get_sql_results": { - "rate_limit": "100/s", - }, - } - beat_schedule = { - "reports.scheduler": { - "task": "reports.scheduler", - "schedule": crontab(minute="*", hour="*"), - }, - "reports.prune_log": { - "task": "reports.prune_log", - 'schedule': crontab(minute=0, hour=0), - }, - 'cache-warmup-hourly': { - "task": "cache-warmup", - "schedule": crontab(minute="*/30", hour="*"), - "kwargs": { - "strategy_name": "top_n_dashboards", - "top_n": 10, - "since": "7 days ago", - }, - } - } - - CELERY_CONFIG = CeleryConfig - reports: | - EMAIL_PAGE_RENDER_WAIT = 60 - WEBDRIVER_BASEURL = "http://{{ template "superset.fullname" . }}:{{ .Values.service.port }}/" - WEBDRIVER_BASEURL_USER_FRIENDLY = "https://www.example.com/" - WEBDRIVER_TYPE= "chrome" - WEBDRIVER_OPTION_ARGS = [ - "--force-device-scale-factor=2.0", - "--high-dpi-support=2.0", - "--headless", - "--disable-gpu", - "--disable-dev-shm-usage", - # This is required because our process runs as root (in order to install pip packages) - "--no-sandbox", - "--disable-setuid-sandbox", - "--disable-extensions", - ] -``` - -### Load the Examples data and dashboards - -If you are trying Superset out and want some data and dashboards to explore, you can load some examples by creating a `my_values.yaml` and deploying it as described above in the **Configure your setting overrides** step of the **Running** section. -To load the examples, add the following to the `my_values.yaml` file: - -```yaml -init: - loadExamples: true -``` - -:::resources -- [Tutorial: Mastering Data Visualization — Installing Superset on Kubernetes with Helm Chart](https://mahira-technology.medium.com/mastering-data-visualization-installing-superset-on-kubernetes-cluster-using-helm-chart-e4ec99199e1e) -- [Tutorial: Installing Apache Superset in Kubernetes](https://aws.plainenglish.io/installing-apache-superset-in-kubernetes-1aec192ac495) -::: diff --git a/docs/admin_docs/installation/pypi.mdx b/docs/admin_docs/installation/pypi.mdx deleted file mode 100644 index 820ac776b95..00000000000 --- a/docs/admin_docs/installation/pypi.mdx +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: PyPI -hide_title: true -sidebar_position: 4 -version: 1 ---- - -import useBaseUrl from "@docusaurus/useBaseUrl"; - -# Installing Superset from PyPI - -
![]({useBaseUrl("/img/pypi.png")
-- -This page describes how to install Superset using the `apache_superset` package [published on PyPI](https://pypi.org/project/apache_superset/). - -## OS Dependencies - -Superset stores database connection information in its metadata database. For that purpose, we use -the cryptography Python library to encrypt connection passwords. Unfortunately, this library has OS -level dependencies. - -**Debian and Ubuntu** - -Ubuntu **24.04** uses python 3.12 per default, which currently is not supported by Superset. You need to add a second python installation of 3.11 and install the required additional dependencies. -```bash -sudo add-apt-repository ppa:deadsnakes/ppa -sudo apt update -sudo apt install python3.11 python3.11-dev python3.11-venv build-essential libssl-dev libffi-dev libsasl2-dev libldap2-dev default-libmysqlclient-dev -``` - -In Ubuntu **20.04 and 22.04** the following command will ensure that the required dependencies are installed: - -```bash -sudo apt-get install build-essential libssl-dev libffi-dev python3-dev python3-pip libsasl2-dev libldap2-dev default-libmysqlclient-dev -``` - -In Ubuntu **before 20.04** the following command will ensure that the required dependencies are installed: - -```bash -sudo apt-get install build-essential libssl-dev libffi-dev python-dev python-pip libsasl2-dev libldap2-dev default-libmysqlclient-dev -``` - -**Fedora and RHEL-derivative Linux distributions** - -Install the following packages using the `yum` package manager: - -```bash -sudo yum install gcc gcc-c++ libffi-devel python-devel python-pip python-wheel openssl-devel cyrus-sasl-devel openldap-devel -``` - -In more recent versions of CentOS and Fedora, you may need to install a slightly different set of packages using `dnf`: - -```bash -sudo dnf install gcc gcc-c++ libffi-devel python3-devel python3-pip python3-wheel openssl-devel cyrus-sasl-devel openldap-devel -``` - -Also, on CentOS, you may need to upgrade pip for the install to work: - -```bash -pip3 install --upgrade pip -``` - -**Mac OS X** - -If you're not on the latest version of OS X, we recommend upgrading because we've found that many -issues people have run into are linked to older versions of Mac OS X. After updating, install the -latest version of XCode command line tools: - -```bash -xcode-select --install -``` - -We don't recommend using the system installed Python. Instead, first install the -[homebrew](https://brew.sh/) manager and then run the following commands: - -```bash -brew install readline pkg-config libffi openssl mysql postgresql@14 -``` - -You should install a recent version of Python. Refer to the -[pyproject.toml](https://github.com/apache/superset/blob/master/pyproject.toml) file for a list of Python -versions officially supported by Superset. We'd recommend using a Python version manager -like [pyenv](https://github.com/pyenv/pyenv) -(and also [pyenv-virtualenv](https://github.com/pyenv/pyenv-virtualenv)). - -Let's also make sure we have the latest version of `pip` and `setuptools`: - -```bash -pip install --upgrade setuptools pip -``` - -Lastly, you may need to set LDFLAGS and CFLAGS for certain Python packages to properly build. You can export these variables with: - -```bash -export LDFLAGS="-L$(brew --prefix openssl)/lib" -export CFLAGS="-I$(brew --prefix openssl)/include" -``` - -These will now be available when pip installing requirements. - -## Python Virtual Environment - -We highly recommend installing Superset inside of a virtual environment. - -You can create and activate a virtual environment using the following commands. Ensure you are using a compatible version of python. You might have to explicitly use for example `python3.11` instead of `python3`. - -```bash -# virtualenv is shipped in Python 3.6+ as venv instead of pyvenv. -# See https://docs.python.org/3.6/library/venv.html -python3 -m venv venv -. venv/bin/activate -``` - -Or with pyenv-virtualenv: - -```bash -# Here we name the virtual env 'superset' -pyenv virtualenv superset -pyenv activate superset -``` - -Once you activated your virtual environment, all of the Python packages you install or uninstall -will be confined to this environment. You can exit the environment by running `deactivate` on the -command line. - -### Installing and Initializing Superset - -First, start by installing `apache_superset`: - -```bash -pip install apache_superset -``` - -Then, define mandatory configurations, SECRET_KEY and FLASK_APP: -```bash -export SUPERSET_SECRET_KEY=YOUR-SECRET-KEY # For production use, make sure this is a strong key, for example generated using `openssl rand -base64 42`. See https://superset.apache.org/admin-docs/configuration/configuring-superset#specifying-a-secret_key -export FLASK_APP=superset -``` - -Then, you need to initialize the database: - -```bash -superset db upgrade -``` - -Finish installing by running through the following commands: - -```bash -# Create an admin user in your metadata database (use `admin` as username to be able to load the examples) -superset fab create-admin - -# Load some data to play with -superset load_examples - -# Create default roles and permissions -superset init - -# To start a development web server on port 8088, use -p to bind to another port -superset run -p 8088 --with-threads --reload --debugger -``` - -If everything worked, you should be able to navigate to `hostname:port` in your browser (e.g. -locally by default at `localhost:8088`) and login using the username and password you created. diff --git a/docs/admin_docs/installation/upgrading-superset.mdx b/docs/admin_docs/installation/upgrading-superset.mdx deleted file mode 100644 index 0cf092a5a06..00000000000 --- a/docs/admin_docs/installation/upgrading-superset.mdx +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Upgrading Superset -hide_title: true -sidebar_position: 6 -version: 1 ---- - -# Upgrading Superset - -## Docker Compose - -First, make sure to shut down the running containers in Docker Compose: - -```bash -docker compose down -``` - -Next, update the folder that mirrors the `superset` repo through git: - -```bash -git pull origin master -``` - -Then, restart the containers and any changed Docker images will be automatically pulled down: - -```bash -docker compose up -``` - -## Updating Superset Manually - -To upgrade superset in a native installation, run the following commands: - -```bash -pip install apache_superset --upgrade -``` - -## Upgrading the Metadata Database - -Migrate the metadata database by running: - -```bash -superset db upgrade -superset init -``` - -While upgrading superset should not delete your charts and dashboards, we recommend following best -practices and to backup your metadata database before upgrading. Before upgrading production, we -recommend upgrading in a staging environment and upgrading production finally during off-peak usage. - -## Breaking Changes - -For a detailed list of breaking changes and migration notes for each version, see -[UPDATING.md](https://github.com/apache/superset/blob/master/UPDATING.md). - -This file documents backwards-incompatible changes and provides guidance for migrating between -major versions, including: -- Configuration changes -- API changes -- Database migrations -- Deprecated features diff --git a/docs/admin_docs/security/cves.mdx b/docs/admin_docs/security/cves.mdx deleted file mode 100644 index a8c2cbb95c2..00000000000 --- a/docs/admin_docs/security/cves.mdx +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: CVEs fixed by release -sidebar_position: 2 ---- -#### Version 6.0.0 - -| CVE | Title | Affected | -|:---------------|:-----------------------------------------------------------------------------------|---------:| -| CVE-2026-23980 | Improper Neutralization of Special Elements used in a SQL Command | < 6.0.0 | -| CVE-2026-23982 | Improper Authorization in Dataset Creation Allows Access Control Bypass | < 6.0.0 | -| CVE-2026-23983 | Information Disclosure of sensitive user info via Tags | < 6.0.0 | -| CVE-2026-23984 | SQLLab Read-Only Bypass on PostgreSQL (DML execution) | < 6.0.0 | - -#### Version 5.0.0 - -| CVE | Title | Affected | -|:---------------|:-----------------------------------------------------------------------------------|---------:| -| CVE-2025-55673 | Exposure of Sensitive Information to an Unauthorized Actor | < 5.0.0 | -| CVE-2025-55674 | Improper Neutralization of Special Elements used in an SQL Command | < 5.0.0 | -| CVE-2025-55675 | Improper Access Control leading to Information Disclosure | < 5.0.0 | - -#### Version 4.1.3 - -| CVE | Title | Affected | -|:---------------|:-----------------------------------------------------------------------------------|---------:| -| CVE-2025-55672 | Improper Neutralization of Input During Web Page Generation | < 4.1.3 | - -#### Version 4.1.2 - -| CVE | Title | Affected | -|:---------------|:-----------------------------------------------------------------------------------|---------:| -| CVE-2025-27696 | Improper authorization leading to resource ownership takeover | < 4.1.2 | -| CVE-2025-48912 | Improper authorization bypass on row level security via SQL Injection | < 4.1.2 | -| CVE-2026-23969 | Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering | < 4.1.2 | - -#### Version 4.1.0 - -| CVE | Title | Affected | -|:---------------|:-----------------------------------------------------------------------------------|---------:| -| CVE-2024-53947 | Improper SQL authorisation, parse for specific postgres functions | < 4.1.0 | -| CVE-2024-53948 | Error verbosity exposes metadata in analytics databases | < 4.1.0 | -| CVE-2024-53949 | Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled | < 4.1.0 | -| CVE-2024-55633 | SQLLab Improper readonly query validation allows unauthorized write access | < 4.1.0 | - -#### Version 4.0.2 - -| CVE | Title | Affected | -|:---------------|:----------------------------|---------:| -| CVE-2024-39887 | Improper SQL authorization | < 4.0.1 | - -#### Version 3.1.3, 4.0.1 - -| CVE | Title | Affected | -|:---------------|:----------------------------|----------------------------:| -| CVE-2024-34693 | Server arbitrary file read | < 3.1.3, >= 4.0.0, < 4.0.1 | - -#### Version 3.1.2 - -| CVE | Title | Affected | -|:---------------|:--------------------------------------------------------|---------:| -| CVE-2024-28148 | Incorrect datasource authorization on explore REST API | < 3.1.2 | - -#### Version 3.0.4, 3.1.1 - -| CVE | Title | Affected | -|:---------------|:-----------------------------------------------------------------------------|----------------------------:| -| CVE-2024-27315 | Improper error handling on alerts | < 3.0.4, >= 3.1.0, < 3.1.1 | -| CVE-2024-24773 | Improper validation of SQL statements allows for unauthorized access to data | < 3.0.4, >= 3.1.0, < 3.1.1 | -| CVE-2024-24772 | Improper Neutralisation of custom SQL on embedded context | < 3.0.4, >= 3.1.0, < 3.1.1 | -| CVE-2024-24779 | Improper data authorization when creating a new dataset | < 3.0.4, >= 3.1.0, < 3.1.1 | -| CVE-2024-26016 | Improper authorization validation on dashboards and charts import | < 3.0.4, >= 3.1.0, < 3.1.1 | - -#### Version 3.0.3 - -| CVE | Title | Affected | -|:---------------|:----------------------------------------------|---------:| -| CVE-2023-49657 | Stored XSS in Dashboard Title and Chart Title | < 3.0.3 | - -#### Version 3.0.2, 2.1.3 - -| CVE | Title | Affected | -|:---------------|:------------------------------------------------------------|---------------------------:| -| CVE-2023-46104 | Allows for uncontrolled resource consumption via a ZIP bomb | < 2.1.3, >= 3.0.0, < 3.0.2 | -| CVE-2023-49736 | SQL Injection on where_in JINJA macro | < 2.1.3, >= 3.0.0, < 3.0.2 | -| CVE-2023-49734 | Privilege Escalation Vulnerability | < 2.1.3, >= 3.0.0, < 3.0.2 | - -#### Version 3.0.0 - -| CVE | Title | Affected | -|:---------------|:------------------------------------------------------------------------|---------:| -| CVE-2023-42502 | Open Redirect Vulnerability | < 3.0.0 | -| CVE-2023-42505 | Sensitive information disclosure on db connection details | < 3.0.0 | - -#### Version 2.1.3 - -| CVE | Title | Affected | -|:---------------|:------------------------------------------------------------------------|---------:| -| CVE-2023-42504 | Lack of rate limiting allows for possible denial of service | < 2.1.3 | - -#### Version 2.1.2 - -| CVE | Title | Affected | -|:---------------|:------------------------------------------------------------------------|---------:| -| CVE-2023-40610 | Privilege escalation with default examples database | < 2.1.2 | -| CVE-2023-42501 | Unnecessary read permissions within the Gamma role | < 2.1.2 | -| CVE-2023-43701 | Stored XSS on API endpoint | < 2.1.2 | - -#### Version 2.1.1 - -| CVE | Title | Affected | -|:---------------|:------------------------------------------------------------------------|---------:| -| CVE-2023-36387 | Improper API permission for low privilege users | < 2.1.1 | -| CVE-2023-36388 | Improper API permission for low privilege users allows for SSRF | < 2.1.1 | -| CVE-2023-27523 | Improper data permission validation on Jinja templated queries | < 2.1.1 | -| CVE-2023-27526 | Improper Authorization check on import charts | < 2.1.1 | -| CVE-2023-39264 | Stack traces enabled by default | < 2.1.1 | -| CVE-2023-39265 | Possible Unauthorized Registration of SQLite Database Connections | < 2.1.1 | -| CVE-2023-37941 | Metadata db write access can lead to remote code execution | < 2.1.1 | -| CVE-2023-32672 | SQL parser edge case bypasses data access authorization | < 2.1.1 | - -#### Version 2.1.0 - -| CVE | Title | Affected | -|:---------------|:------------------------------------------------------------------------|---------:| -| CVE-2023-25504 | Possible SSRF on import datasets | < 2.1.0 | -| CVE-2023-27524 | Session validation vulnerability when using provided default SECRET_KEY | < 2.1.0 | -| CVE-2023-27525 | Incorrect default permissions for Gamma role | < 2.1.0 | -| CVE-2023-30776 | Database connection password leak | < 2.1.0 | - -#### Version 2.0.1 - -| CVE | Title | Affected | -|:---------------|:------------------------------------------------------------|------------------: | -| CVE-2022-41703 | SQL injection vulnerability in adhoc clauses | < 2.0.1 or < 1.5.2 | -| CVE-2022-43717 | Cross-Site Scripting on dashboards | < 2.0.1 or < 1.5.2 | -| CVE-2022-43718 | Cross-Site Scripting vulnerability on upload forms | < 2.0.1 or < 1.5.2 | -| CVE-2022-43719 | Cross Site Request Forgery (CSRF) on accept, request access | < 2.0.1 or < 1.5.2 | -| CVE-2022-43720 | Improper rendering of user input | < 2.0.1 or < 1.5.2 | -| CVE-2022-43721 | Open Redirect Vulnerability | < 2.0.1 or < 1.5.2 | -| CVE-2022-45438 | Dashboard metadata information leak | < 2.0.1 or < 1.5.2 | diff --git a/docs/admin_docs/security/securing_superset.mdx b/docs/admin_docs/security/securing_superset.mdx deleted file mode 100644 index 92d42e385e0..00000000000 --- a/docs/admin_docs/security/securing_superset.mdx +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: Securing Your Superset Installation for Production -sidebar_position: 3 ---- - -> *This guide applies to Apache Superset version 4.0 and later and is an evolving set of best practices that administrators should adapt to their specific deployment architecture.* - -The default Apache Superset configuration is optimized for ease of use and development, not for security. For any production deployment, it is **critical** that you review and apply the following security configurations to harden your instance, protect user data, and prevent unauthorized access. - -This guide provides a comprehensive checklist of essential security configurations and best practices. - -### **Critical Prerequisites: HTTPS/TLS Configuration** - -Running Superset without HTTPS (TLS) is not secure. Without it, all network traffic—including user credentials, session tokens, and sensitive data—is sent in cleartext and can be easily intercepted. - -* **Use a Reverse Proxy:** Your Superset instance should always be deployed behind a reverse proxy (e.g., Nginx, Traefik) or a load balancer (e.g., AWS ALB, Google Cloud Load Balancer) that is configured to handle HTTPS termination. -* **Enforce Modern TLS:** Configure your proxy to enforce TLS 1.2 or higher with strong, industry-standard cipher suites. -* **Implement HSTS:** Use the HTTP Strict Transport Security (HSTS) header to ensure browsers only connect to your Superset instance over HTTPS. This can be configured in your reverse proxy or within Superset's Talisman settings. - -### **`SUPERSET_SECRET_KEY` Management (CRITICAL)** - -This is the most critical security setting for your Superset instance. It is used to sign all session cookies and encrypt sensitive information in the metadata database, such as database connection credentials. - -* **Generate a Unique, Strong Key:** A unique key must be generated for every Superset instance. Use a cryptographically secure method to create it. - ```bash - # Example using openssl to generate a strong key - openssl rand -base64 42 - ``` -* **Store the Key Securely:** The key must be kept confidential. The recommended approach is to store it as an environment variable or in a secrets management system (e.g., AWS Secrets Manager, HashiCorp Vault). **Do not hardcode the key in `superset_config.py` or commit it to version control.** - ```python - # In superset_config.py - import os - SECRET_KEY = os.environ.get('SUPERSET_SECRET_KEY') - ``` - -> #### ⚠️ Warning: Your `SUPERSET_SECRET_KEY` Must Be Unique -> -> **NEVER** reuse the same `SUPERSET_SECRET_KEY` across different environments (e.g., development, staging, production) or different Superset instances. Reusing a key allows cryptographically signed session cookies to be used across those instances, which can lead to a full authentication bypass if a cookie is compromised. Treat this key like a master password. - -### **Session Management Security (CRITICAL)** - -Properly configuring user sessions is essential to prevent session hijacking and ensure that sessions are terminated correctly. - -#### **Use a Server-Side Session Backend (Strongly Recommended for Production)** - -The default stateless cookie-based session handling presents challenges for immediate session invalidation upon logout. For all production deployments, we strongly recommend configuring an optional server-side session backend like Redis, Memcached, or a database. This ensures that session data is stored securely on the server and can be instantly destroyed upon logout, rendering any copied session cookies immediately useless. - -**Example `superset_config.py` for Redis:** - -```python -# superset_config.py -from redis import Redis -import os - -# 1. Enable server-side sessions -SESSION_SERVER_SIDE = True - -# 2. Choose your backend (e.g., 'redis', 'memcached', 'filesystem', 'sqlalchemy') -SESSION_TYPE = 'redis' - -# 3. Configure your Redis connection -# Use environment variables for sensitive details -SESSION_REDIS = Redis( - host=os.environ.get('REDIS_HOST', 'localhost'), - port=int(os.environ.get('REDIS_PORT', 6379)), - password=os.environ.get('REDIS_PASSWORD'), - db=int(os.environ.get('REDIS_DB', 0)), - ssl=os.environ.get('REDIS_SSL_ENABLED', 'True').lower() == 'true', - ssl_cert_reqs='required' # Or another appropriate SSL setting -) - -# 4. Ensure the session cookie is signed for integrity -SESSION_USE_SIGNER = True -``` - -#### **Configure Session Lifetime and Cookie Security Flags** - -This is mandatory for *all* deployments, whether stateless or server-side. - -```python -# superset_config.py -from datetime import timedelta - -# Set a short absolute session timeout -# The default is 31 days, which is NOT recommended for production. -PERMANENT_SESSION_LIFETIME = timedelta(hours=8) - -# Enforce secure cookie flags to prevent browser-based attacks -SESSION_COOKIE_SECURE = True # Transmit cookie only over HTTPS -SESSION_COOKIE_HTTPONLY = True # Prevent client-side JS from accessing the cookie -SESSION_COOKIE_SAMESITE = 'Lax' # Provide protection against CSRF attacks -``` - -> ##### Note on iFrame Embedding and `SESSION_COOKIE_SAMESITE` ->The recommended default setting `'Lax'` provides good CSRF protection for most use cases. However, if you need to embed Superset dashboards into other applications using an iFrame, you will need to change this setting to `'None'`. - -SESSION_COOKIE_SAMESITE = 'None' - -Setting SameSite to 'None' requires that SESSION_COOKIE_SECURE is also set to True. Be aware that this configuration disables some of the browser's built-in CSRF protections to allow for cross-domain functionality, so it should only be used when iFrame embedding is necessary. - -### **Authentication and Authorization** - -While Superset's built-in database authentication is convenient, for production it's highly recommended to integrate with an enterprise-grade identity provider (IdP). - - * **Use an Enterprise IdP:** Configure authentication via OAuth or LDAP to leverage your organization's existing identity management system. This provides benefits like Single Sign-On (SSO), Multi-Factor Authentication (MFA), and centralized user provisioning/deprovisioning. - * **Principle of Least Privilege:** Assign users to the most restrictive roles necessary for their jobs. Avoid over-provisioning users with Admin or Alpha roles, and ensure row-level security is applied where appropriate. - * **Admin Accounts:** Delete or disable the default admin user after a new administrative account has been configured. - -### **Content Security Policy (CSP) and Other Headers** - -Superset can use Flask-Talisman to set security headers. However, it must be explicitly enabled. - -> #### ⚠️ Important: Talisman is Disabled by Default -> -> In Superset 4.0 and later, Talisman is disabled by default (`TALISMAN_ENABLED = False`). You **must** explicitly enable it in your `superset_config.py` for the security headers defined in `TALISMAN_CONFIG` to take effect. - -Here's the documentation section how how to set up Talisman: https://superset.apache.org/admin-docs/security/#content-security-policy-csp - -### **Database Security** - -> #### ❗ Superset is Not a Database Firewall -> -> It is essential to understand that **Apache Superset is a data visualization and exploration platform, not a database firewall or a comprehensive security solution for your data warehouse.** While Superset provides features to help manage data access, the ultimate responsibility for securing your underlying databases lies with your database administrators (DBAs) and security teams. This includes managing network access, user privileges, and fine-grained permissions directly within the database. The configurations below are an important secondary layer of security but should not be your only line of defense. - - * **Use a Dedicated Database User:** The database connection configured in Superset should use a dedicated, limited-privilege database user. This user should only have the minimum required permissions (e.g., `SELECT` on specific schemas) for the data sources it needs to query. It should **not** have `INSERT`, `UPDATE`, `DELETE`, or administrative privileges. - * **Restrict Dangerous SQL Functions:** To mitigate potential SQL injection risks, configure the `DISALLOWED_SQL_FUNCTIONS` list in your `superset_config.py`. Be aware that this is a defense-in-depth measure, not a substitute for proper database permissions. - -### **Additional Security Layers** - - * **Web Application Firewall (WAF):** Deploying Superset behind a WAF (e.g., Cloudflare, AWS WAF) is strongly recommended. A WAF with a standard ruleset (like the OWASP Core Rule Set) provides a critical layer of defense against common attacks like SQL Injection, XSS, and remote code execution. - -### **Monitoring and Logging** - - * **Configure Structured Logging:** Set up a robust logging configuration to capture important security events. - * **Centralize Logs:** Ship logs from all Superset components (frontend, worker, etc.) to a centralized SIEM (Security Information and Event Management) system for analysis and alerting. - * **Monitor Key Events:** Create alerts for suspicious activities, including: - * Multiple failed login attempts for a single user or from a single IP address. - * Changes to user roles or permissions. - * Creation or deletion of high-privilege users. - * Attempts to use disallowed SQL functions. - ------ - -### **Appendix A: Production Deployment Checklist** - -#### **Initial Setup:** - - - [ ] HTTPS/TLS is configured and enforced via a reverse proxy. - - [ ] A unique, strong `SUPERSET_SECRET_KEY` is generated and secured in an environment variable or secrets vault. - - [ ] Server-side session management is configured (e.g., Redis). - - [ ] `PERMANENT_SESSION_LIFETIME` is set to a short duration (e.g., 8 hours). - - [ ] All session cookie security flags (`Secure`, `HttpOnly`, `SameSite`) are enabled. - - [ ] `DEBUG` mode is set to `False`. - - [ ] Talisman is explicitly enabled and configured with a strict Content Security Policy. - - [ ] Database connections use dedicated, limited-privilege accounts. - - [ ] Authentication is integrated with an enterprise identity provider (OAuth/LDAP). - - [ ] A Web Application Firewall (WAF) is deployed in front of Superset. - - [ ] Logging is configured and logs are shipped to a central monitoring system. - -#### **Ongoing Maintenance:** - - - [ ] Regularly update to the latest major or minor versions of Superset. Those versions receive up-to-date security patches. - - [ ] Rotate the `SUPERSET_SECRET_KEY` periodically (e.g., quarterly) and after any potential security incident. - - [ ] Conduct quarterly access reviews for all users. - - [ ] Assuming logging and monitoring is in place, review security monitoring alerts weekly. - -### **Appendix B: `SECRET_KEY` Rotation and Compromise Response** - -**Why and When to Rotate the `SECRET_KEY`** -Rotating the `SUPERSET_SECRET_KEY` is a critical security procedure. It is mandatory after a known or suspected compromise and is a best practice when an employee with access to the key departs. While periodic rotation can limit the window of exposure for an unknown leak, it is a high-impact operation that will invalidate all user sessions and requires careful execution to avoid breaking your instance. The principles behind managing this key align with general best practices for cryptographic storage, which are further detailed in the OWASP Cryptographic Storage Cheat Sheet here: https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html - -**Procedure for Rotating the Key** -The procedure for safely rotating the SECRET_KEY must be followed precisely to avoid locking yourself out of your instance. The official Apache Superset documentation maintains the correct, up-to-date procedure. Please follow the official guide here: -https://superset.apache.org/admin-docs/configuration/configuring-superset/#rotating-to-a-newer-secret_key - -:::resources -- [Blog: Running Apache Superset on the Open Internet](https://preset.io/blog/running-apache-superset-on-the-open-internet-a-report-from-the-fireline/) -- [Blog: How Security Vulnerabilities are Reported & Handled in Apache Superset](https://preset.io/blog/how-security-vulnerabilities-are-reported-and-handled-in-apache-superset/) -::: diff --git a/docs/admin_docs/security/security.mdx b/docs/admin_docs/security/security.mdx deleted file mode 100644 index 6190925d8ab..00000000000 --- a/docs/admin_docs/security/security.mdx +++ /dev/null @@ -1,639 +0,0 @@ ---- -title: Security Configurations -sidebar_position: 1 ---- - -Authentication and authorization in Superset is handled by Flask AppBuilder (FAB), an application development framework -built on top of Flask. FAB provides authentication, user management, permissions and roles. -Please read its [Security documentation](https://flask-appbuilder.readthedocs.io/en/latest/security.html). - -### Provided Roles - -Superset ships with a set of roles that are handled by Superset itself. You can assume -that these roles will stay up-to-date as Superset evolves (and as you update Superset versions). - -Even though **Admin** users have the ability, we don't recommend altering the -permissions associated with each role (e.g. by removing or adding permissions to them). The permissions -associated with each role will be re-synchronized to their original values when you run -the **superset init** command (often done between Superset versions). - -A table with the permissions for these roles can be found at [/RESOURCES/STANDARD_ROLES.md](https://github.com/apache/superset/blob/master/RESOURCES/STANDARD_ROLES.md). - -### Admin - -Admins have all possible rights, including granting or revoking rights from other -users and altering other people’s slices and dashboards. - ->#### Threat Model and Privilege Boundaries: The Admin Role -> ->Apache Superset is built with a granular permission model where users assigned the Admin role are considered fully trusted. Admins possess complete control over the application's configuration, UI rendering, and access controls. -> ->Consequently, actions performed by an Admin that alter the application's behavior or presentation—such as injecting custom CSS, modifying Jinja templates, or altering security flags—are intended administrative capabilities by design. -> ->In accordance with MITRE CNA Rule 4.1, a vulnerability must represent a violation of an explicit security policy. Because the Admin role is defined as a trusted operational boundary, actions executed with Admin privileges do not cross a security perimeter. Therefore, exploit vectors that strictly require Admin access are not classified as security vulnerabilities and are ineligible for CVE assignment. - -### Alpha - -Alpha users have access to all data sources, but they cannot grant or revoke access -from other users. They are also limited to altering the objects that they own. Alpha users can add and alter data sources. - -### Gamma - -Gamma users have limited access. They can only consume data coming from data sources -they have been given access to through another complementary role. They only have access to -view the slices and dashboards made from data sources that they have access to. Currently Gamma -users are not able to alter or add data sources. We assume that they are mostly content consumers, though they can create slices and dashboards. - -Also note that when Gamma users look at the dashboards and slices list view, they will -only see the objects that they have access to. - -### sql_lab - -The **sql_lab** role grants access to SQL Lab. Note that while **Admin** users have access -to all databases by default, both **Alpha** and **Gamma** users need to be given access on a per database basis. - -Beyond the base `sql_lab` role, two additional SQL Lab permissions must be explicitly granted for users who need these capabilities: - -| Permission | Feature | -|------------|---------| -| `can_estimate_query_cost` on `SQLLab` | Estimate query cost before running | -| `can_format_sql` on `SQLLab` | Format SQL using the database's dialect | - -Grant these in **Security → List Roles** by adding the permissions to the relevant role. - -### Public - -The **Public** role is the most restrictive built-in role, designed specifically for anonymous/unauthenticated -users who need to view dashboards. It provides minimal read-only access for: - -- Viewing dashboards and charts -- Using interactive dashboard filters -- Accessing dashboard and chart permalinks -- Reading embedded dashboards -- Viewing annotations on charts - -The Public role explicitly excludes: -- Any write permissions on dashboards, charts, or datasets -- SQL Lab access -- Share functionality -- User profile or admin features -- Menu access to most Superset features - -Anonymous users are automatically assigned the Public role when `AUTH_ROLE_PUBLIC` is configured -(a Flask-AppBuilder setting). The `PUBLIC_ROLE_LIKE` setting is **optional** and controls what -permissions are synced to the Public role when you run `superset init`: - -```python -# Optional: Sync sensible default permissions to the Public role -PUBLIC_ROLE_LIKE = "Public" - -# Alternative: Copy permissions from Gamma for broader access -# PUBLIC_ROLE_LIKE = "Gamma" -``` - -If you prefer to manually configure the Public role's permissions (or use `DASHBOARD_RBAC` to -grant access at the dashboard level), you do not need to set `PUBLIC_ROLE_LIKE`. - -**Important notes:** - -- **Data access is still required:** The Public role only grants UI/API permissions. You must - also grant access to specific datasets necessary to view a dashboard. As with other roles, - this can be done in two ways: - - - **Without `DASHBOARD_RBAC`:** Dashboards only appear in the list and are accessible if - the user has permission to at least one of their datasets. Grant dataset access by editing - the Public role in the Superset UI (Menu → Security → List Roles → Public) and adding the - relevant data sources. All published dashboards using those datasets become visible. - - - **With `DASHBOARD_RBAC` enabled:** Anonymous users will only see dashboards where the - "Public" role has been explicitly added in the dashboard's properties. Dataset permissions - are not required—DASHBOARD_RBAC handles the cascading permissions check. This provides - fine-grained control over which dashboards are publicly visible. - -- **Role synchronization:** Built-in role permissions (Admin, Alpha, Gamma, sql_lab, and Public - when `PUBLIC_ROLE_LIKE = "Public"`) are synchronized when you run `superset init`. Any manual - permission edits to these roles may be overwritten during upgrades. To customize the Public - role permissions, you can either: - - Edit the Public role directly and avoid setting `PUBLIC_ROLE_LIKE` (permissions won't be - overwritten by `superset init`) - - Copy the Public role via "Copy Role" in the Superset web UI, save it under a different name - (e.g., "Public_Custom"), customize the permissions, then update **both** configs: - `PUBLIC_ROLE_LIKE = "Public_Custom"` and `AUTH_ROLE_PUBLIC = "Public_Custom"` - -### Managing Data Source Access for Gamma Roles - -Here’s how to provide users access to only specific datasets. First make sure the users with -limited access have [only] the Gamma role assigned to them. Second, create a new role (Menu -> Security -> List Roles) and click the + sign. - -This new window allows you to give this new role a name, attribute it to users and select the -tables in the **Permissions** dropdown. To select the data sources you want to associate with this role, simply click on the dropdown and use the typeahead to search for your table names. - -You can then confirm with users assigned to the **Gamma** role that they see the -objects (dashboards and slices) associated with the tables you just extended them. - -### Dashboard Access Control - -Access to dashboards is managed via owners (users that have edit permissions to the dashboard). -Non-owner user access can be managed in two ways. Note that dashboards must be published to be -visible to other users. - -#### Dataset-Based Access (Default) - -By default, users can view published dashboards if they have access to at least one dataset -used in that dashboard. Grant dataset access by adding the relevant data source permissions -to a role (Menu → Security → List Roles). - -This is the simplest approach but provides all-or-nothing access based on dataset permissions— -if a user has access to a dataset, they can see all published dashboards using that dataset. - -#### Dashboard-Level Access (DASHBOARD_RBAC) - -For fine-grained control over which dashboards specific roles can access, enable the -`DASHBOARD_RBAC` feature flag: - -```python -FEATURE_FLAGS = { - "DASHBOARD_RBAC": True, -} -``` - -With this enabled, you can assign specific roles to each dashboard in its properties. Users -will only see dashboards where their role is explicitly added. - -**Important considerations:** -- Dashboard access **bypasses** dataset-level checks—granting a role access to a dashboard - implicitly grants read access to all charts and datasets in that dashboard -- Dashboards without any assigned roles fall back to dataset-based access -- The dashboard must still be published to be visible - -This feature is particularly useful for: -- Making specific dashboards public while keeping others private -- Granting access to dashboards without exposing the underlying datasets for other uses -- Creating dashboard-specific access patterns that don't align with dataset ownership - -### SQL Execution Security Considerations - -Apache Superset includes features designed to provide safeguards when interacting with connected databases, such as the `DISALLOWED_SQL_FUNCTIONS` configuration setting. This aims to prevent the execution of potentially harmful database functions or system variables directly from Superset interfaces like SQL Lab. - -However, it is crucial to understand the following: - -**Superset is Not a Database Firewall**: Superset's built-in checks, like `DISALLOWED_SQL_FUNCTIONS`, provide a layer of protection but cannot guarantee complete security against all database-level threats or advanced bypass techniques (like specific comment injection methods). They should be viewed as a supplement to, not a replacement for, robust database security. - -**Configuration is Key**: The effectiveness of Superset's safeguards heavily depends on proper configuration by the Superset administrator. This includes maintaining the `DISALLOWED_SQL_FUNCTIONS` list, carefully managing feature flags (like `ENABLE_TEMPLATE_PROCESSING`), and configuring other security settings appropriately. - -**Database Security is Paramount**: The ultimate responsibility for securing database access, controlling permissions, and preventing unauthorized function execution lies with the database administrators (DBAs) and security teams managing the underlying database instance. - -**Recommended Database Practices**: We strongly recommend implementing security best practices at the database level, including: -* **Least Privilege**: Connecting Superset using dedicated database user accounts with the minimum permissions required for Superset's operation (typically read-only access to necessary schemas/tables). -* **Database Roles & Permissions**: Utilizing database-native roles and permissions to restrict access to sensitive functions, system variables (like `@@hostname`), schemas, or tables. -* **Network Security**: Employing network-level controls like database firewalls or proxies to restrict connections. -* **Auditing**: Enabling database-level auditing to monitor executed queries and access patterns. - -By combining Superset's configurable safeguards with strong database-level security practices, you can achieve a more robust and layered security posture. - -**Dataset Sample Access**: The `get_samples()` endpoint now enforces datasource-level access control. Users can only fetch sample rows from datasets they have been explicitly granted access to — the same permission check applied when running chart queries. This closes a prior gap where unauthenticated or under-privileged access could retrieve sample data. - -### REST API for user & role management - -Flask-AppBuilder supports a REST API for user CRUD, -but this feature is in beta and is not enabled by default in Superset. -To enable this feature, set the following in your Superset configuration: - -```python -FAB_ADD_SECURITY_API = True -``` - -Once configured, the documentation for additional "Security" endpoints will be visible in Swagger for you to explore. - -### API Key Authentication - -Superset supports long-lived API keys for service accounts, CI/CD pipelines, and programmatic integrations (including MCP clients). - -#### Enabling API Key Authentication - -API key authentication is **disabled by default**. To turn it on, set the Flask-AppBuilder config value in `superset_config.py` and also enable the matching feature flag so the management UI is exposed: - -```python -FAB_API_KEY_ENABLED = True - -FEATURE_FLAGS = { - "FAB_API_KEY_ENABLED": True, -} -``` - -The config value registers the `ApiKeyApi` blueprint on the backend; the feature flag controls whether the UI for managing keys appears for the user. See the [Feature Flags](/admin-docs/configuration/feature-flags) documentation for more on feature flag configuration. - -#### Creating an API Key - -Once enabled, each user manages their own keys from their profile page: - -1. Open the user menu (top-right) and click **Info** to navigate to the User Info page -2. Expand the **API Keys** section -3. Click **+ API Key** -4. Enter a name and (optionally) an expiration date -5. Copy the generated token — it is shown only once - -Only users with the `can_read` and `can_write` permissions on `ApiKey` (granted by default to Admins) can manage API keys. - -#### Using an API Key - -Pass the key as a Bearer token in the `Authorization` header: - -``` -Authorization: Bearer
Column 1
-
- Column 2
-
- Column 3
-
- Responsive Column 1
-
- Responsive Column 2
-
- Responsive Column 3
-
- Responsive Column 4
-
-
- This is a simple example component
-
- )}
-/>
diff --git a/docs/components/ui-components/button.mdx b/docs/components/ui-components/button.mdx
deleted file mode 100644
index 2102d146efe..00000000000
--- a/docs/components/ui-components/button.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
-
----
-title: Button Component
-sidebar_position: 1
----
-
-import { StoryExample, StoryWithControls } from '../../src/components/StorybookWrapper';
-import { Button } from '../../../superset-frontend/packages/superset-ui-core/src/components/Button';
-
-# Button Component
-
-The Button component is a fundamental UI element used throughout Superset for user interactions.
-
-## Basic Usage
-
-The default button with primary styling:
-
-
-
-Dashboards (28 endpoints) — Create, read, update, and delete dashboards.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Bulk delete dashboards](/developer-docs/api/bulk-delete-dashboards) | `/api/v1/dashboard/` | -| `GET` | [Get a list of dashboards](/developer-docs/api/get-a-list-of-dashboards) | `/api/v1/dashboard/` | -| `POST` | [Create a new dashboard](/developer-docs/api/create-a-new-dashboard) | `/api/v1/dashboard/` | -| `GET` | [Get metadata information about this API resource (dashboard--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-dashboard-info) | `/api/v1/dashboard/_info` | -| `GET` | [Get a dashboard detail information](/developer-docs/api/get-a-dashboard-detail-information) | `/api/v1/dashboard/{id_or_slug}` | -| `GET` | [Get a dashboard's chart definitions.](/developer-docs/api/get-a-dashboards-chart-definitions) | `/api/v1/dashboard/{id_or_slug}/charts` | -| `POST` | [Create a copy of an existing dashboard](/developer-docs/api/create-a-copy-of-an-existing-dashboard) | `/api/v1/dashboard/{id_or_slug}/copy/` | -| `GET` | [Get dashboard's datasets](/developer-docs/api/get-dashboards-datasets) | `/api/v1/dashboard/{id_or_slug}/datasets` | -| `DELETE` | [Delete a dashboard's embedded configuration](/developer-docs/api/delete-a-dashboards-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` | -| `GET` | [Get the dashboard's embedded configuration](/developer-docs/api/get-the-dashboards-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` | -| `POST` | [Set a dashboard's embedded configuration](/developer-docs/api/set-a-dashboards-embedded-configuration) | `/api/v1/dashboard/{id_or_slug}/embedded` | -| `PUT` | [Update dashboard by id_or_slug embedded](/developer-docs/api/update-dashboard-by-id-or-slug-embedded) | `/api/v1/dashboard/{id_or_slug}/embedded` | -| `GET` | [Get dashboard's tabs](/developer-docs/api/get-dashboards-tabs) | `/api/v1/dashboard/{id_or_slug}/tabs` | -| `DELETE` | [Delete a dashboard](/developer-docs/api/delete-a-dashboard) | `/api/v1/dashboard/{pk}` | -| `PUT` | [Update a dashboard](/developer-docs/api/update-a-dashboard) | `/api/v1/dashboard/{pk}` | -| `POST` | [Compute and cache a screenshot (dashboard-pk-cache-dashboard-screenshot)](/developer-docs/api/compute-and-cache-a-screenshot-dashboard-pk-cache-dashboard-screenshot) | `/api/v1/dashboard/{pk}/cache_dashboard_screenshot/` | -| `PUT` | [Update chart customizations configuration for a dashboard.](/developer-docs/api/update-chart-customizations-configuration-for-a-dashboard) | `/api/v1/dashboard/{pk}/chart_customizations` | -| `PUT` | [Update colors configuration for a dashboard.](/developer-docs/api/update-colors-configuration-for-a-dashboard) | `/api/v1/dashboard/{pk}/colors` | -| `GET` | [Export dashboard as example bundle](/developer-docs/api/export-dashboard-as-example-bundle) | `/api/v1/dashboard/{pk}/export_as_example/` | -| `DELETE` | [Remove the dashboard from the user favorite list](/developer-docs/api/remove-the-dashboard-from-the-user-favorite-list) | `/api/v1/dashboard/{pk}/favorites/` | -| `POST` | [Mark the dashboard as favorite for the current user](/developer-docs/api/mark-the-dashboard-as-favorite-for-the-current-user) | `/api/v1/dashboard/{pk}/favorites/` | -| `PUT` | [Update native filters configuration for a dashboard.](/developer-docs/api/update-native-filters-configuration-for-a-dashboard) | `/api/v1/dashboard/{pk}/filters` | -| `GET` | [Get a computed screenshot from cache (dashboard-pk-screenshot-digest)](/developer-docs/api/get-a-computed-screenshot-from-cache-dashboard-pk-screenshot-digest) | `/api/v1/dashboard/{pk}/screenshot/{digest}/` | -| `GET` | [Get dashboard's thumbnail](/developer-docs/api/get-dashboards-thumbnail) | `/api/v1/dashboard/{pk}/thumbnail/{digest}/` | -| `GET` | [Download multiple dashboards as YAML files](/developer-docs/api/download-multiple-dashboards-as-yaml-files) | `/api/v1/dashboard/export/` | -| `GET` | [Check favorited dashboards for current user](/developer-docs/api/check-favorited-dashboards-for-current-user) | `/api/v1/dashboard/favorite_status/` | -| `POST` | [Import dashboard(s) with associated charts/datasets/databases](/developer-docs/api/import-dashboard-s-with-associated-charts-datasets-databases) | `/api/v1/dashboard/import/` | -| `GET` | [Get related fields data (dashboard-related-column-name)](/developer-docs/api/get-related-fields-data-dashboard-related-column-name) | `/api/v1/dashboard/related/{column_name}` | - -
-
-
-Charts (20 endpoints) — Create, read, update, and delete charts (slices).
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Bulk delete charts](/developer-docs/api/bulk-delete-charts) | `/api/v1/chart/` | -| `GET` | [Get a list of charts](/developer-docs/api/get-a-list-of-charts) | `/api/v1/chart/` | -| `POST` | [Create a new chart](/developer-docs/api/create-a-new-chart) | `/api/v1/chart/` | -| `GET` | [Get metadata information about this API resource (chart--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-chart-info) | `/api/v1/chart/_info` | -| `GET` | [Get a chart detail information](/developer-docs/api/get-a-chart-detail-information) | `/api/v1/chart/{id_or_uuid}` | -| `DELETE` | [Delete a chart](/developer-docs/api/delete-a-chart) | `/api/v1/chart/{pk}` | -| `PUT` | [Update a chart](/developer-docs/api/update-a-chart) | `/api/v1/chart/{pk}` | -| `GET` | [Compute and cache a screenshot (chart-pk-cache-screenshot)](/developer-docs/api/compute-and-cache-a-screenshot-chart-pk-cache-screenshot) | `/api/v1/chart/{pk}/cache_screenshot/` | -| `GET` | [Return payload data response for a chart](/developer-docs/api/return-payload-data-response-for-a-chart) | `/api/v1/chart/{pk}/data/` | -| `DELETE` | [Remove the chart from the user favorite list](/developer-docs/api/remove-the-chart-from-the-user-favorite-list) | `/api/v1/chart/{pk}/favorites/` | -| `POST` | [Mark the chart as favorite for the current user](/developer-docs/api/mark-the-chart-as-favorite-for-the-current-user) | `/api/v1/chart/{pk}/favorites/` | -| `GET` | [Get a computed screenshot from cache (chart-pk-screenshot-digest)](/developer-docs/api/get-a-computed-screenshot-from-cache-chart-pk-screenshot-digest) | `/api/v1/chart/{pk}/screenshot/{digest}/` | -| `GET` | [Get chart thumbnail](/developer-docs/api/get-chart-thumbnail) | `/api/v1/chart/{pk}/thumbnail/{digest}/` | -| `POST` | [Return payload data response for the given query (chart-data)](/developer-docs/api/return-payload-data-response-for-the-given-query-chart-data) | `/api/v1/chart/data` | -| `GET` | [Return payload data response for the given query (chart-data-cache-key)](/developer-docs/api/return-payload-data-response-for-the-given-query-chart-data-cache-key) | `/api/v1/chart/data/{cache_key}` | -| `GET` | [Download multiple charts as YAML files](/developer-docs/api/download-multiple-charts-as-yaml-files) | `/api/v1/chart/export/` | -| `GET` | [Check favorited charts for current user](/developer-docs/api/check-favorited-charts-for-current-user) | `/api/v1/chart/favorite_status/` | -| `POST` | [Import chart(s) with associated datasets and databases](/developer-docs/api/import-chart-s-with-associated-datasets-and-databases) | `/api/v1/chart/import/` | -| `GET` | [Get related fields data (chart-related-column-name)](/developer-docs/api/get-related-fields-data-chart-related-column-name) | `/api/v1/chart/related/{column_name}` | -| `PUT` | [Warm up the cache for the chart](/developer-docs/api/warm-up-the-cache-for-the-chart) | `/api/v1/chart/warm_up_cache` | - -
-
-
-Datasets (19 endpoints) — Manage datasets (tables) used for building charts.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Bulk delete datasets](/developer-docs/api/bulk-delete-datasets) | `/api/v1/dataset/` | -| `GET` | [Get a list of datasets](/developer-docs/api/get-a-list-of-datasets) | `/api/v1/dataset/` | -| `POST` | [Create a new dataset](/developer-docs/api/create-a-new-dataset) | `/api/v1/dataset/` | -| `GET` | [Get metadata information about this API resource (dataset--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-dataset-info) | `/api/v1/dataset/_info` | -| `GET` | [Get a dataset](/developer-docs/api/get-a-dataset) | `/api/v1/dataset/{id_or_uuid}` | -| `GET` | [Get charts and dashboards count associated to a dataset](/developer-docs/api/get-charts-and-dashboards-count-associated-to-a-dataset) | `/api/v1/dataset/{id_or_uuid}/related_objects` | -| `DELETE` | [Delete a dataset](/developer-docs/api/delete-a-dataset) | `/api/v1/dataset/{pk}` | -| `PUT` | [Update a dataset](/developer-docs/api/update-a-dataset) | `/api/v1/dataset/{pk}` | -| `DELETE` | [Delete a dataset column](/developer-docs/api/delete-a-dataset-column) | `/api/v1/dataset/{pk}/column/{column_id}` | -| `GET` | [Get dataset drill info](/developer-docs/api/get-dataset-drill-info) | `/api/v1/dataset/{pk}/drill_info/` | -| `DELETE` | [Delete a dataset metric](/developer-docs/api/delete-a-dataset-metric) | `/api/v1/dataset/{pk}/metric/{metric_id}` | -| `PUT` | [Refresh and update columns of a dataset](/developer-docs/api/refresh-and-update-columns-of-a-dataset) | `/api/v1/dataset/{pk}/refresh` | -| `GET` | [Get distinct values from field data (dataset-distinct-column-name)](/developer-docs/api/get-distinct-values-from-field-data-dataset-distinct-column-name) | `/api/v1/dataset/distinct/{column_name}` | -| `POST` | [Duplicate a dataset](/developer-docs/api/duplicate-a-dataset) | `/api/v1/dataset/duplicate` | -| `GET` | [Download multiple datasets as YAML files](/developer-docs/api/download-multiple-datasets-as-yaml-files) | `/api/v1/dataset/export/` | -| `POST` | [Retrieve a table by name, or create it if it does not exist](/developer-docs/api/retrieve-a-table-by-name-or-create-it-if-it-does-not-exist) | `/api/v1/dataset/get_or_create/` | -| `POST` | [Import dataset(s) with associated databases](/developer-docs/api/import-dataset-s-with-associated-databases) | `/api/v1/dataset/import/` | -| `GET` | [Get related fields data (dataset-related-column-name)](/developer-docs/api/get-related-fields-data-dataset-related-column-name) | `/api/v1/dataset/related/{column_name}` | -| `PUT` | [Warm up the cache for each chart powered by the given table](/developer-docs/api/warm-up-the-cache-for-each-chart-powered-by-the-given-table) | `/api/v1/dataset/warm_up_cache` | - -
-
-
-#### Data Exploration
-
-Database (30 endpoints) — Manage database connections and metadata.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get a list of databases](/developer-docs/api/get-a-list-of-databases) | `/api/v1/database/` | -| `POST` | [Create a new database](/developer-docs/api/create-a-new-database) | `/api/v1/database/` | -| `GET` | [Get metadata information about this API resource (database--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-database-info) | `/api/v1/database/_info` | -| `DELETE` | [Delete a database](/developer-docs/api/delete-a-database) | `/api/v1/database/{pk}` | -| `GET` | [Get a database](/developer-docs/api/get-a-database) | `/api/v1/database/{pk}` | -| `PUT` | [Change a database](/developer-docs/api/change-a-database) | `/api/v1/database/{pk}` | -| `GET` | [Get all catalogs from a database](/developer-docs/api/get-all-catalogs-from-a-database) | `/api/v1/database/{pk}/catalogs/` | -| `GET` | [Get a database connection info](/developer-docs/api/get-a-database-connection-info) | `/api/v1/database/{pk}/connection` | -| `GET` | [Get function names supported by a database](/developer-docs/api/get-function-names-supported-by-a-database) | `/api/v1/database/{pk}/function_names/` | -| `GET` | [Get charts and dashboards count associated to a database](/developer-docs/api/get-charts-and-dashboards-count-associated-to-a-database) | `/api/v1/database/{pk}/related_objects/` | -| `GET` | [The list of the database schemas where to upload information](/developer-docs/api/the-list-of-the-database-schemas-where-to-upload-information) | `/api/v1/database/{pk}/schemas_access_for_file_upload/` | -| `GET` | [Get all schemas from a database](/developer-docs/api/get-all-schemas-from-a-database) | `/api/v1/database/{pk}/schemas/` | -| `GET` | [Get database select star for table (database-pk-select-star-table-name)](/developer-docs/api/get-database-select-star-for-table-database-pk-select-star-table-name) | `/api/v1/database/{pk}/select_star/{table_name}/` | -| `GET` | [Get database select star for table (database-pk-select-star-table-name-schema-name)](/developer-docs/api/get-database-select-star-for-table-database-pk-select-star-table-name-schema-name) | `/api/v1/database/{pk}/select_star/{table_name}/{schema_name}/` | -| `POST` | [Re-sync all permissions for a database connection](/developer-docs/api/re-sync-all-permissions-for-a-database-connection) | `/api/v1/database/{pk}/sync_permissions/` | -| `GET` | [Get table extra metadata (database-pk-table-extra-table-name-schema-name)](/developer-docs/api/get-table-extra-metadata-database-pk-table-extra-table-name-schema-name) | `/api/v1/database/{pk}/table_extra/{table_name}/{schema_name}/` | -| `GET` | [Get table metadata](/developer-docs/api/get-table-metadata) | `/api/v1/database/{pk}/table_metadata/` | -| `GET` | [Get table extra metadata (database-pk-table-metadata-extra)](/developer-docs/api/get-table-extra-metadata-database-pk-table-metadata-extra) | `/api/v1/database/{pk}/table_metadata/extra/` | -| `GET` | [Get database table metadata](/developer-docs/api/get-database-table-metadata) | `/api/v1/database/{pk}/table/{table_name}/{schema_name}/` | -| `GET` | [Get a list of tables for given database](/developer-docs/api/get-a-list-of-tables-for-given-database) | `/api/v1/database/{pk}/tables/` | -| `POST` | [Upload a file to a database table](/developer-docs/api/upload-a-file-to-a-database-table) | `/api/v1/database/{pk}/upload/` | -| `POST` | [Validate arbitrary SQL](/developer-docs/api/validate-arbitrary-sql) | `/api/v1/database/{pk}/validate_sql/` | -| `GET` | [Get names of databases currently available](/developer-docs/api/get-names-of-databases-currently-available) | `/api/v1/database/available/` | -| `GET` | [Download database(s) and associated dataset(s) as a zip file](/developer-docs/api/download-database-s-and-associated-dataset-s-as-a-zip-file) | `/api/v1/database/export/` | -| `POST` | [Import database(s) with associated datasets](/developer-docs/api/import-database-s-with-associated-datasets) | `/api/v1/database/import/` | -| `GET` | [Receive personal access tokens from OAuth2](/developer-docs/api/receive-personal-access-tokens-from-o-auth-2) | `/api/v1/database/oauth2/` | -| `GET` | [Get related fields data (database-related-column-name)](/developer-docs/api/get-related-fields-data-database-related-column-name) | `/api/v1/database/related/{column_name}` | -| `POST` | [Test a database connection](/developer-docs/api/test-a-database-connection) | `/api/v1/database/test_connection/` | -| `POST` | [Upload a file and returns file metadata](/developer-docs/api/upload-a-file-and-returns-file-metadata) | `/api/v1/database/upload_metadata/` | -| `POST` | [Validate database connection parameters](/developer-docs/api/validate-database-connection-parameters) | `/api/v1/database/validate_parameters/` | - -
-
-
-Explore (1 endpoints) — Chart exploration and data querying endpoints.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Assemble Explore related information in a single endpoint](/developer-docs/api/assemble-explore-related-information-in-a-single-endpoint) | `/api/v1/explore/` | - -
-
-
-SQL Lab (7 endpoints) — Execute SQL queries and manage SQL Lab sessions.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get the bootstrap data for SqlLab page](/developer-docs/api/get-the-bootstrap-data-for-sql-lab-page) | `/api/v1/sqllab/` | -| `POST` | [Estimate the SQL query execution cost](/developer-docs/api/estimate-the-sql-query-execution-cost) | `/api/v1/sqllab/estimate/` | -| `POST` | [Execute a SQL query](/developer-docs/api/execute-a-sql-query) | `/api/v1/sqllab/execute/` | -| `POST` | [Export SQL query results to CSV with streaming](/developer-docs/api/export-sql-query-results-to-csv-with-streaming) | `/api/v1/sqllab/export_streaming/` | -| `GET` | [Export the SQL query results to a CSV](/developer-docs/api/export-the-sql-query-results-to-a-csv) | `/api/v1/sqllab/export/{client_id}/` | -| `POST` | [Format SQL code](/developer-docs/api/format-sql-code) | `/api/v1/sqllab/format_sql/` | -| `GET` | [Get the result of a SQL query execution](/developer-docs/api/get-the-result-of-a-sql-query-execution) | `/api/v1/sqllab/results/` | - -
-
-
-Queries (17 endpoints) — View and manage SQL Lab query history.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get a list of queries](/developer-docs/api/get-a-list-of-queries) | `/api/v1/query/` | -| `GET` | [Get query detail information](/developer-docs/api/get-query-detail-information) | `/api/v1/query/{pk}` | -| `GET` | [Get distinct values from field data (query-distinct-column-name)](/developer-docs/api/get-distinct-values-from-field-data-query-distinct-column-name) | `/api/v1/query/distinct/{column_name}` | -| `GET` | [Get related fields data (query-related-column-name)](/developer-docs/api/get-related-fields-data-query-related-column-name) | `/api/v1/query/related/{column_name}` | -| `POST` | [Manually stop a query with client_id](/developer-docs/api/manually-stop-a-query-with-client-id) | `/api/v1/query/stop` | -| `GET` | [Get a list of queries that changed after last_updated_ms](/developer-docs/api/get-a-list-of-queries-that-changed-after-last-updated-ms) | `/api/v1/query/updated_since` | -| `DELETE` | [Bulk delete saved queries](/developer-docs/api/bulk-delete-saved-queries) | `/api/v1/saved_query/` | -| `GET` | [Get a list of saved queries](/developer-docs/api/get-a-list-of-saved-queries) | `/api/v1/saved_query/` | -| `POST` | [Create a saved query](/developer-docs/api/create-a-saved-query) | `/api/v1/saved_query/` | -| `GET` | [Get metadata information about this API resource (saved-query--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-saved-query-info) | `/api/v1/saved_query/_info` | -| `DELETE` | [Delete a saved query](/developer-docs/api/delete-a-saved-query) | `/api/v1/saved_query/{pk}` | -| `GET` | [Get a saved query](/developer-docs/api/get-a-saved-query) | `/api/v1/saved_query/{pk}` | -| `PUT` | [Update a saved query](/developer-docs/api/update-a-saved-query) | `/api/v1/saved_query/{pk}` | -| `GET` | [Get distinct values from field data (saved-query-distinct-column-name)](/developer-docs/api/get-distinct-values-from-field-data-saved-query-distinct-column-name) | `/api/v1/saved_query/distinct/{column_name}` | -| `GET` | [Download multiple saved queries as YAML files](/developer-docs/api/download-multiple-saved-queries-as-yaml-files) | `/api/v1/saved_query/export/` | -| `POST` | [Import saved queries with associated databases](/developer-docs/api/import-saved-queries-with-associated-databases) | `/api/v1/saved_query/import/` | -| `GET` | [Get related fields data (saved-query-related-column-name)](/developer-docs/api/get-related-fields-data-saved-query-related-column-name) | `/api/v1/saved_query/related/{column_name}` | - -
-
-
-Datasources (2 endpoints) — Query datasource metadata and column values.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get possible values for a datasource column](/developer-docs/api/get-possible-values-for-a-datasource-column) | `/api/v1/datasource/{datasource_type}/{datasource_id}/column/{column_name}/values/` | -| `POST` | [Validate a SQL expression against a datasource](/developer-docs/api/validate-a-sql-expression-against-a-datasource) | `/api/v1/datasource/{datasource_type}/{datasource_id}/validate_expression/` | - -
-
-
-#### Organization & Customization
-
-Advanced Data Type (2 endpoints) — Advanced data type operations and conversions.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Return an AdvancedDataTypeResponse](/developer-docs/api/return-an-advanced-data-type-response) | `/api/v1/advanced_data_type/convert` | -| `GET` | [Return a list of available advanced data types](/developer-docs/api/return-a-list-of-available-advanced-data-types) | `/api/v1/advanced_data_type/types` | - -
-
-
-Tags (15 endpoints) — Organize assets with tags.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Bulk delete tags](/developer-docs/api/bulk-delete-tags) | `/api/v1/tag/` | -| `GET` | [Get a list of tags](/developer-docs/api/get-a-list-of-tags) | `/api/v1/tag/` | -| `POST` | [Create a tag](/developer-docs/api/create-a-tag) | `/api/v1/tag/` | -| `GET` | [Get metadata information about tag API endpoints](/developer-docs/api/get-metadata-information-about-tag-api-endpoints) | `/api/v1/tag/_info` | -| `POST` | [Add tags to an object](/developer-docs/api/add-tags-to-an-object) | `/api/v1/tag/{object_type}/{object_id}/` | -| `DELETE` | [Delete a tagged object](/developer-docs/api/delete-a-tagged-object) | `/api/v1/tag/{object_type}/{object_id}/{tag}/` | -| `DELETE` | [Delete a tag](/developer-docs/api/delete-a-tag) | `/api/v1/tag/{pk}` | -| `GET` | [Get a tag detail information](/developer-docs/api/get-a-tag-detail-information) | `/api/v1/tag/{pk}` | -| `PUT` | [Update a tag](/developer-docs/api/update-a-tag) | `/api/v1/tag/{pk}` | -| `DELETE` | [Delete tag by pk favorites](/developer-docs/api/delete-tag-by-pk-favorites) | `/api/v1/tag/{pk}/favorites/` | -| `POST` | [Create tag by pk favorites](/developer-docs/api/create-tag-by-pk-favorites) | `/api/v1/tag/{pk}/favorites/` | -| `POST` | [Bulk create tags and tagged objects](/developer-docs/api/bulk-create-tags-and-tagged-objects) | `/api/v1/tag/bulk_create` | -| `GET` | [Get tag favorite status](/developer-docs/api/get-tag-favorite-status) | `/api/v1/tag/favorite_status/` | -| `GET` | [Get all objects associated with a tag](/developer-docs/api/get-all-objects-associated-with-a-tag) | `/api/v1/tag/get_objects/` | -| `GET` | [Get related fields data (tag-related-column-name)](/developer-docs/api/get-related-fields-data-tag-related-column-name) | `/api/v1/tag/related/{column_name}` | - -
-
-
-Annotation Layers (14 endpoints) — Manage annotation layers and annotations for charts.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Delete multiple annotation layers in a bulk operation](/developer-docs/api/delete-multiple-annotation-layers-in-a-bulk-operation) | `/api/v1/annotation_layer/` | -| `GET` | [Get a list of annotation layers (annotation-layer)](/developer-docs/api/get-a-list-of-annotation-layers-annotation-layer) | `/api/v1/annotation_layer/` | -| `POST` | [Create an annotation layer (annotation-layer)](/developer-docs/api/create-an-annotation-layer-annotation-layer) | `/api/v1/annotation_layer/` | -| `GET` | [Get metadata information about this API resource (annotation-layer--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-annotation-layer-info) | `/api/v1/annotation_layer/_info` | -| `DELETE` | [Delete annotation layer (annotation-layer-pk)](/developer-docs/api/delete-annotation-layer-annotation-layer-pk) | `/api/v1/annotation_layer/{pk}` | -| `GET` | [Get an annotation layer (annotation-layer-pk)](/developer-docs/api/get-an-annotation-layer-annotation-layer-pk) | `/api/v1/annotation_layer/{pk}` | -| `PUT` | [Update an annotation layer (annotation-layer-pk)](/developer-docs/api/update-an-annotation-layer-annotation-layer-pk) | `/api/v1/annotation_layer/{pk}` | -| `DELETE` | [Bulk delete annotation layers](/developer-docs/api/bulk-delete-annotation-layers) | `/api/v1/annotation_layer/{pk}/annotation/` | -| `GET` | [Get a list of annotation layers (annotation-layer-pk-annotation)](/developer-docs/api/get-a-list-of-annotation-layers-annotation-layer-pk-annotation) | `/api/v1/annotation_layer/{pk}/annotation/` | -| `POST` | [Create an annotation layer (annotation-layer-pk-annotation)](/developer-docs/api/create-an-annotation-layer-annotation-layer-pk-annotation) | `/api/v1/annotation_layer/{pk}/annotation/` | -| `DELETE` | [Delete annotation layer (annotation-layer-pk-annotation-annotation-id)](/developer-docs/api/delete-annotation-layer-annotation-layer-pk-annotation-annotation-id) | `/api/v1/annotation_layer/{pk}/annotation/{annotation_id}` | -| `GET` | [Get an annotation layer (annotation-layer-pk-annotation-annotation-id)](/developer-docs/api/get-an-annotation-layer-annotation-layer-pk-annotation-annotation-id) | `/api/v1/annotation_layer/{pk}/annotation/{annotation_id}` | -| `PUT` | [Update an annotation layer (annotation-layer-pk-annotation-annotation-id)](/developer-docs/api/update-an-annotation-layer-annotation-layer-pk-annotation-annotation-id) | `/api/v1/annotation_layer/{pk}/annotation/{annotation_id}` | -| `GET` | [Get related fields data (annotation-layer-related-column-name)](/developer-docs/api/get-related-fields-data-annotation-layer-related-column-name) | `/api/v1/annotation_layer/related/{column_name}` | - -
-
-
-#### Sharing & Embedding
-
-CSS Templates (8 endpoints) — Manage CSS templates for custom dashboard styling.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Bulk delete CSS templates](/developer-docs/api/bulk-delete-css-templates) | `/api/v1/css_template/` | -| `GET` | [Get a list of CSS templates](/developer-docs/api/get-a-list-of-css-templates) | `/api/v1/css_template/` | -| `POST` | [Create a CSS template](/developer-docs/api/create-a-css-template) | `/api/v1/css_template/` | -| `GET` | [Get metadata information about this API resource (css-template--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-css-template-info) | `/api/v1/css_template/_info` | -| `DELETE` | [Delete a CSS template](/developer-docs/api/delete-a-css-template) | `/api/v1/css_template/{pk}` | -| `GET` | [Get a CSS template](/developer-docs/api/get-a-css-template) | `/api/v1/css_template/{pk}` | -| `PUT` | [Update a CSS template](/developer-docs/api/update-a-css-template) | `/api/v1/css_template/{pk}` | -| `GET` | [Get related fields data (css-template-related-column-name)](/developer-docs/api/get-related-fields-data-css-template-related-column-name) | `/api/v1/css_template/related/{column_name}` | - -
-
-
-Dashboard Permanent Link (2 endpoints) — Permanent links to dashboard states.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `POST` | [Create a new dashboard's permanent link](/developer-docs/api/create-a-new-dashboards-permanent-link) | `/api/v1/dashboard/{pk}/permalink` | -| `GET` | [Get dashboard's permanent link state](/developer-docs/api/get-dashboards-permanent-link-state) | `/api/v1/dashboard/permalink/{key}` | - -
-
-
-Explore Permanent Link (2 endpoints) — Permanent links to chart explore states.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `POST` | [Create a new permanent link (explore-permalink)](/developer-docs/api/create-a-new-permanent-link-explore-permalink) | `/api/v1/explore/permalink` | -| `GET` | [Get chart's permanent link state](/developer-docs/api/get-charts-permanent-link-state) | `/api/v1/explore/permalink/{key}` | - -
-
-
-SQL Lab Permanent Link (2 endpoints) — Permanent links to SQL Lab states.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `POST` | [Create a new permanent link (sqllab-permalink)](/developer-docs/api/create-a-new-permanent-link-sqllab-permalink) | `/api/v1/sqllab/permalink` | -| `GET` | [Get permanent link state for SQLLab editor.](/developer-docs/api/get-permanent-link-state-for-sql-lab-editor) | `/api/v1/sqllab/permalink/{key}` | - -
-
-
-Embedded Dashboard (1 endpoints) — Configure embedded dashboard settings.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get a report schedule log (embedded-dashboard-uuid)](/developer-docs/api/get-a-report-schedule-log-embedded-dashboard-uuid) | `/api/v1/embedded_dashboard/{uuid}` | - -
-
-
-Dashboard Filter State (4 endpoints) — Manage temporary filter state for dashboards.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `POST` | [Create a dashboard's filter state](/developer-docs/api/create-a-dashboards-filter-state) | `/api/v1/dashboard/{pk}/filter_state` | -| `DELETE` | [Delete a dashboard's filter state value](/developer-docs/api/delete-a-dashboards-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` | -| `GET` | [Get a dashboard's filter state value](/developer-docs/api/get-a-dashboards-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` | -| `PUT` | [Update a dashboard's filter state value](/developer-docs/api/update-a-dashboards-filter-state-value) | `/api/v1/dashboard/{pk}/filter_state/{key}` | - -
-
-
-#### Scheduling & Alerts
-
-Explore Form Data (4 endpoints) — Manage temporary form data for chart exploration.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `POST` | [Create a new form_data](/developer-docs/api/create-a-new-form-data) | `/api/v1/explore/form_data` | -| `DELETE` | [Delete a form_data](/developer-docs/api/delete-a-form-data) | `/api/v1/explore/form_data/{key}` | -| `GET` | [Get a form_data](/developer-docs/api/get-a-form-data) | `/api/v1/explore/form_data/{key}` | -| `PUT` | [Update an existing form_data](/developer-docs/api/update-an-existing-form-data) | `/api/v1/explore/form_data/{key}` | - -
-
-
-#### Security & Access Control
-
-Report Schedules (11 endpoints) — Configure scheduled reports and alerts.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Bulk delete report schedules](/developer-docs/api/bulk-delete-report-schedules) | `/api/v1/report/` | -| `GET` | [Get a list of report schedules](/developer-docs/api/get-a-list-of-report-schedules) | `/api/v1/report/` | -| `POST` | [Create a report schedule](/developer-docs/api/create-a-report-schedule) | `/api/v1/report/` | -| `GET` | [Get metadata information about this API resource (report--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-report-info) | `/api/v1/report/_info` | -| `DELETE` | [Delete a report schedule](/developer-docs/api/delete-a-report-schedule) | `/api/v1/report/{pk}` | -| `GET` | [Get a report schedule](/developer-docs/api/get-a-report-schedule) | `/api/v1/report/{pk}` | -| `PUT` | [Update a report schedule](/developer-docs/api/update-a-report-schedule) | `/api/v1/report/{pk}` | -| `GET` | [Get a list of report schedule logs](/developer-docs/api/get-a-list-of-report-schedule-logs) | `/api/v1/report/{pk}/log/` | -| `GET` | [Get a report schedule log (report-pk-log-log-id)](/developer-docs/api/get-a-report-schedule-log-report-pk-log-log-id) | `/api/v1/report/{pk}/log/{log_id}` | -| `GET` | [Get related fields data (report-related-column-name)](/developer-docs/api/get-related-fields-data-report-related-column-name) | `/api/v1/report/related/{column_name}` | -| `GET` | [Get slack channels](/developer-docs/api/get-slack-channels) | `/api/v1/report/slack_channels/` | - -
-
-
-Security Roles (11 endpoints) — Manage security roles and their permissions.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get security roles](/developer-docs/api/get-security-roles) | `/api/v1/security/roles/` | -| `POST` | [Create security roles](/developer-docs/api/create-security-roles) | `/api/v1/security/roles/` | -| `GET` | [Get security roles info](/developer-docs/api/get-security-roles-info) | `/api/v1/security/roles/_info` | -| `DELETE` | [Delete security roles by pk](/developer-docs/api/delete-security-roles-by-pk) | `/api/v1/security/roles/{pk}` | -| `GET` | [Get security roles by pk](/developer-docs/api/get-security-roles-by-pk) | `/api/v1/security/roles/{pk}` | -| `PUT` | [Update security roles by pk](/developer-docs/api/update-security-roles-by-pk) | `/api/v1/security/roles/{pk}` | -| `PUT` | [Update security roles by role_id groups](/developer-docs/api/update-security-roles-by-role-id-groups) | `/api/v1/security/roles/{role_id}/groups` | -| `POST` | [Create security roles by role_id permissions](/developer-docs/api/create-security-roles-by-role-id-permissions) | `/api/v1/security/roles/{role_id}/permissions` | -| `GET` | [Get security roles by role_id permissions](/developer-docs/api/get-security-roles-by-role-id-permissions) | `/api/v1/security/roles/{role_id}/permissions/` | -| `PUT` | [Update security roles by role_id users](/developer-docs/api/update-security-roles-by-role-id-users) | `/api/v1/security/roles/{role_id}/users` | -| `GET` | [List roles](/developer-docs/api/list-roles) | `/api/v1/security/roles/search/` | - -
-
-
-Security Users (6 endpoints) — Manage user accounts.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get security users](/developer-docs/api/get-security-users) | `/api/v1/security/users/` | -| `POST` | [Create security users](/developer-docs/api/create-security-users) | `/api/v1/security/users/` | -| `GET` | [Get security users info](/developer-docs/api/get-security-users-info) | `/api/v1/security/users/_info` | -| `DELETE` | [Delete security users by pk](/developer-docs/api/delete-security-users-by-pk) | `/api/v1/security/users/{pk}` | -| `GET` | [Get security users by pk](/developer-docs/api/get-security-users-by-pk) | `/api/v1/security/users/{pk}` | -| `PUT` | [Update security users by pk](/developer-docs/api/update-security-users-by-pk) | `/api/v1/security/users/{pk}` | - -
-
-
-Security Permissions (3 endpoints) — View available permissions.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get security permissions](/developer-docs/api/get-security-permissions) | `/api/v1/security/permissions/` | -| `GET` | [Get security permissions info](/developer-docs/api/get-security-permissions-info) | `/api/v1/security/permissions/_info` | -| `GET` | [Get security permissions by pk](/developer-docs/api/get-security-permissions-by-pk) | `/api/v1/security/permissions/{pk}` | - -
-
-
-Security Resources (View Menus) (6 endpoints) — Manage security resources (view menus).
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get security resources](/developer-docs/api/get-security-resources) | `/api/v1/security/resources/` | -| `POST` | [Create security resources](/developer-docs/api/create-security-resources) | `/api/v1/security/resources/` | -| `GET` | [Get security resources info](/developer-docs/api/get-security-resources-info) | `/api/v1/security/resources/_info` | -| `DELETE` | [Delete security resources by pk](/developer-docs/api/delete-security-resources-by-pk) | `/api/v1/security/resources/{pk}` | -| `GET` | [Get security resources by pk](/developer-docs/api/get-security-resources-by-pk) | `/api/v1/security/resources/{pk}` | -| `PUT` | [Update security resources by pk](/developer-docs/api/update-security-resources-by-pk) | `/api/v1/security/resources/{pk}` | - -
-
-
-Security Permissions on Resources (View Menus) (6 endpoints) — Permission-resource mappings.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get security permissions resources](/developer-docs/api/get-security-permissions-resources) | `/api/v1/security/permissions-resources/` | -| `POST` | [Create security permissions resources](/developer-docs/api/create-security-permissions-resources) | `/api/v1/security/permissions-resources/` | -| `GET` | [Get security permissions resources info](/developer-docs/api/get-security-permissions-resources-info) | `/api/v1/security/permissions-resources/_info` | -| `DELETE` | [Delete security permissions resources by pk](/developer-docs/api/delete-security-permissions-resources-by-pk) | `/api/v1/security/permissions-resources/{pk}` | -| `GET` | [Get security permissions resources by pk](/developer-docs/api/get-security-permissions-resources-by-pk) | `/api/v1/security/permissions-resources/{pk}` | -| `PUT` | [Update security permissions resources by pk](/developer-docs/api/update-security-permissions-resources-by-pk) | `/api/v1/security/permissions-resources/{pk}` | - -
-
-
-#### Import/Export & Administration
-
-Row Level Security (8 endpoints) — Manage row-level security rules for data access.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Bulk delete RLS rules](/developer-docs/api/bulk-delete-rls-rules) | `/api/v1/rowlevelsecurity/` | -| `GET` | [Get a list of RLS](/developer-docs/api/get-a-list-of-rls) | `/api/v1/rowlevelsecurity/` | -| `POST` | [Create a new RLS rule](/developer-docs/api/create-a-new-rls-rule) | `/api/v1/rowlevelsecurity/` | -| `GET` | [Get metadata information about this API resource (rowlevelsecurity--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-rowlevelsecurity-info) | `/api/v1/rowlevelsecurity/_info` | -| `DELETE` | [Delete an RLS](/developer-docs/api/delete-an-rls) | `/api/v1/rowlevelsecurity/{pk}` | -| `GET` | [Get an RLS](/developer-docs/api/get-an-rls) | `/api/v1/rowlevelsecurity/{pk}` | -| `PUT` | [Update an RLS rule](/developer-docs/api/update-an-rls-rule) | `/api/v1/rowlevelsecurity/{pk}` | -| `GET` | [Get related fields data (rowlevelsecurity-related-column-name)](/developer-docs/api/get-related-fields-data-rowlevelsecurity-related-column-name) | `/api/v1/rowlevelsecurity/related/{column_name}` | - -
-
-
-Import/export (2 endpoints) — Import and export Superset assets.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Export all assets](/developer-docs/api/export-all-assets) | `/api/v1/assets/export/` | -| `POST` | [Import multiple assets](/developer-docs/api/import-multiple-assets) | `/api/v1/assets/import/` | - -
-
-
-CacheRestApi (1 endpoints) — Cache management and invalidation operations.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `POST` | [Invalidate cache records and remove the database records](/developer-docs/api/invalidate-cache-records-and-remove-the-database-records) | `/api/v1/cachekey/invalidate` | - -
-
-
-#### User & System
-
-LogRestApi (4 endpoints) — Access audit logs and activity history.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get a list of logs](/developer-docs/api/get-a-list-of-logs) | `/api/v1/log/` | -| `POST` | [Create log](/developer-docs/api/create-log) | `/api/v1/log/` | -| `GET` | [Get a log detail information](/developer-docs/api/get-a-log-detail-information) | `/api/v1/log/{pk}` | -| `GET` | [Get recent activity data for a user](/developer-docs/api/get-recent-activity-data-for-a-user) | `/api/v1/log/recent_activity/` | - -
-
-
-Current User (3 endpoints) — Get information about the authenticated user.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get the user object](/developer-docs/api/get-the-user-object) | `/api/v1/me/` | -| `PUT` | [Update the current user](/developer-docs/api/update-the-current-user) | `/api/v1/me/` | -| `GET` | [Get the user roles](/developer-docs/api/get-the-user-roles) | `/api/v1/me/roles/` | - -
-
-
-User (1 endpoints) — User profile and preferences.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get the user avatar](/developer-docs/api/get-the-user-avatar) | `/api/v1/user/{user_id}/avatar.png` | - -
-
-
-Menu (1 endpoints) — Get the Superset menu structure.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get menu](/developer-docs/api/get-menu) | `/api/v1/menu/` | - -
-
-
-Available Domains (1 endpoints) — Get available domains for the Superset instance.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get all available domains](/developer-docs/api/get-all-available-domains) | `/api/v1/available_domains/` | - -
-
-
-AsyncEventsRestApi (1 endpoints) — Real-time event streaming via Server-Sent Events (SSE).
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Read off of the Redis events stream](/developer-docs/api/read-off-of-the-redis-events-stream) | `/api/v1/async_event/` | - -
-
-
-#### Other
-
-OpenApi (1 endpoints) — Access the OpenAPI specification.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get api by version openapi](/developer-docs/api/get-api-by-version-openapi) | `/api/{version}/_openapi` | - -
-
-
-Security Groups (6 endpoints) — Endpoints related to Security Groups.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get security groups](/developer-docs/api/get-security-groups) | `/api/v1/security/groups/` | -| `POST` | [Create security groups](/developer-docs/api/create-security-groups) | `/api/v1/security/groups/` | -| `GET` | [Get security groups info](/developer-docs/api/get-security-groups-info) | `/api/v1/security/groups/_info` | -| `DELETE` | [Delete security groups by pk](/developer-docs/api/delete-security-groups-by-pk) | `/api/v1/security/groups/{pk}` | -| `GET` | [Get security groups by pk](/developer-docs/api/get-security-groups-by-pk) | `/api/v1/security/groups/{pk}` | -| `PUT` | [Update security groups by pk](/developer-docs/api/update-security-groups-by-pk) | `/api/v1/security/groups/{pk}` | - -
-
-
-Themes (14 endpoints) — Manage UI themes for customizing Superset's appearance.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `DELETE` | [Bulk delete themes](/developer-docs/api/bulk-delete-themes) | `/api/v1/theme/` | -| `GET` | [Get a list of themes](/developer-docs/api/get-a-list-of-themes) | `/api/v1/theme/` | -| `POST` | [Create a theme](/developer-docs/api/create-a-theme) | `/api/v1/theme/` | -| `GET` | [Get metadata information about this API resource (theme--info)](/developer-docs/api/get-metadata-information-about-this-api-resource-theme-info) | `/api/v1/theme/_info` | -| `DELETE` | [Delete a theme](/developer-docs/api/delete-a-theme) | `/api/v1/theme/{pk}` | -| `GET` | [Get a theme](/developer-docs/api/get-a-theme) | `/api/v1/theme/{pk}` | -| `PUT` | [Update a theme](/developer-docs/api/update-a-theme) | `/api/v1/theme/{pk}` | -| `PUT` | [Set a theme as the system dark theme](/developer-docs/api/set-a-theme-as-the-system-dark-theme) | `/api/v1/theme/{pk}/set_system_dark` | -| `PUT` | [Set a theme as the system default theme](/developer-docs/api/set-a-theme-as-the-system-default-theme) | `/api/v1/theme/{pk}/set_system_default` | -| `GET` | [Download multiple themes as YAML files](/developer-docs/api/download-multiple-themes-as-yaml-files) | `/api/v1/theme/export/` | -| `POST` | [Import themes from a ZIP file](/developer-docs/api/import-themes-from-a-zip-file) | `/api/v1/theme/import/` | -| `GET` | [Get related fields data (theme-related-column-name)](/developer-docs/api/get-related-fields-data-theme-related-column-name) | `/api/v1/theme/related/{column_name}` | -| `DELETE` | [Clear the system dark theme](/developer-docs/api/clear-the-system-dark-theme) | `/api/v1/theme/unset_system_dark` | -| `DELETE` | [Clear the system default theme](/developer-docs/api/clear-the-system-default-theme) | `/api/v1/theme/unset_system_default` | - -
-
-
----
-
-### Additional Resources
-
-- [Superset REST API Blog Post](https://preset.io/blog/2020-10-01-superset-api/)
-- [Accessing APIs with Superset](https://preset.io/blog/accessing-apis-with-superset/)
diff --git a/docs/developer_docs/components/TODO.md b/docs/developer_docs/components/TODO.md
deleted file mode 100644
index c3564104795..00000000000
--- a/docs/developer_docs/components/TODO.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: Components TODO
-sidebar_class_name: hidden
----
-
-# Components TODO
-
-These components were found but not yet supported for documentation generation.
-Future phases will add support for these sources.
-
-## Summary
-
-- **Total skipped:** 19 story files
-- **Reason:** Import path resolution not yet implemented
-
-## Skipped by Source
-
-### App Components
-
-9 components
-
-- [ ] `superset-frontend/src/components/AlteredSliceTag/AlteredSliceTag.stories.tsx`
-- [ ] `superset-frontend/src/components/Chart/DrillDetail/DrillDetailTableControls.stories.tsx`
-- [ ] `superset-frontend/src/components/CopyToClipboard/CopyToClipboard.stories.tsx`
-- [ ] `superset-frontend/src/components/ErrorMessage/ErrorAlert.stories.tsx`
-- [ ] `superset-frontend/src/components/FacePile/FacePile.stories.tsx`
-- [ ] `superset-frontend/src/components/FilterableTable/FilterableTable.stories.tsx`
-- [ ] `superset-frontend/src/components/RowCountLabel/RowCountLabel.stories.tsx`
-- [ ] `superset-frontend/src/components/Tag/Tag.stories.tsx`
-- [ ] `superset-frontend/src/components/TagsList/TagsList.stories.tsx`
-
-### Dashboard Components
-
-2 components
-
-- [ ] `superset-frontend/src/dashboard/components/AnchorLink/AnchorLink.stories.tsx`
-- [ ] `superset-frontend/src/dashboard/components/nativeFilters/FilterBar/FilterControls/FilterDivider.stories.tsx`
-
-### Explore Components
-
-4 components
-
-- [ ] `superset-frontend/src/explore/components/ControlHeader.stories.tsx`
-- [ ] `superset-frontend/src/explore/components/RunQueryButton/RunQueryButton.stories.tsx`
-- [ ] `superset-frontend/src/explore/components/controls/BoundsControl.stories.tsx`
-- [ ] `superset-frontend/src/explore/components/controls/SliderControl.stories.tsx`
-
-### Feature Components
-
-2 components
-
-- [ ] `superset-frontend/src/features/datasets/AddDataset/DatasetPanel/DatasetPanel.stories.tsx`
-- [ ] `superset-frontend/src/features/home/LanguagePicker.stories.tsx`
-
-### Filter Components
-
-2 components
-
-- [ ] `superset-frontend/src/filters/components/Range/RangeFilterPlugin.stories.tsx`
-- [ ] `superset-frontend/src/filters/components/Select/SelectFilterPlugin.stories.tsx`
-
-## How to Add Support
-
-1. Determine the correct import path for the source
-2. Update `generate-superset-components.mjs` to handle the source
-3. Add source to `SUPPORTED_SOURCES` array
-4. Re-run the generator
-
----
-
-*Auto-generated by generate-superset-components.mjs*
diff --git a/docs/developer_docs/components/design-system/dropdowncontainer.mdx b/docs/developer_docs/components/design-system/dropdowncontainer.mdx
deleted file mode 100644
index 1d6b5e20772..00000000000
--- a/docs/developer_docs/components/design-system/dropdowncontainer.mdx
+++ /dev/null
@@ -1,167 +0,0 @@
----
-title: DropdownContainer
-sidebar_label: DropdownContainer
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# DropdownContainer
-
-DropdownContainer arranges items horizontally and moves overflowing items into a dropdown popover. Resize the container to see the overflow behavior.
-
-## Live Example
-
-UserRegistrationsRestAPI (8 endpoints) — Endpoints related to UserRegistrationsRestAPI.
- -| Method | Endpoint | Description | -|--------|----------|-------------| -| `GET` | [Get security user registrations](/developer-docs/api/get-security-user-registrations) | `/api/v1/security/user_registrations/` | -| `POST` | [Create security user registrations](/developer-docs/api/create-security-user-registrations) | `/api/v1/security/user_registrations/` | -| `GET` | [Get security user registrations info](/developer-docs/api/get-security-user-registrations-info) | `/api/v1/security/user_registrations/_info` | -| `DELETE` | [Delete security user registrations by pk](/developer-docs/api/delete-security-user-registrations-by-pk) | `/api/v1/security/user_registrations/{pk}` | -| `GET` | [Get security user registrations by pk](/developer-docs/api/get-security-user-registrations-by-pk) | `/api/v1/security/user_registrations/{pk}` | -| `PUT` | [Update security user registrations by pk](/developer-docs/api/update-security-user-registrations-by-pk) | `/api/v1/security/user_registrations/{pk}` | -| `GET` | [Get distinct values from field data (security-user-registrations-distinct-column-name)](/developer-docs/api/get-distinct-values-from-field-data-security-user-registrations-distinct-column-name) | `/api/v1/security/user_registrations/distinct/{column_name}` | -| `GET` | [Get related fields data (security-user-registrations-related-column-name)](/developer-docs/api/get-related-fields-data-security-user-registrations-related-column-name) | `/api/v1/security/user_registrations/related/{column_name}` | - -
-
- );
-}
-```
-
-## With Select Filters
-
-```tsx live
-function SelectFilters() {
- const items = ['Region', 'Category', 'Date Range', 'Status', 'Owner'].map(
- (label, i) => ({
- id: 'filter-' + i,
- element: React.createElement('div', {
- style: { minWidth: 150, padding: '4px 12px', background: '#f5f5f5', border: '1px solid #d9d9d9', borderRadius: 4 },
- }, label + ': All'),
- })
- );
- return (
-
- Drag the right edge to resize and see items overflow into a dropdown
-
-
-
- );
-}
-```
-
-
-
-## Import
-
-```tsx
-import { DropdownContainer } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/DropdownContainer/DropdownContainer.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/design-system/flex.mdx b/docs/developer_docs/components/design-system/flex.mdx
deleted file mode 100644
index b74f06c7f4e..00000000000
--- a/docs/developer_docs/components/design-system/flex.mdx
+++ /dev/null
@@ -1,197 +0,0 @@
----
-title: Flex
-sidebar_label: Flex
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# Flex
-
-The Flex component from Superset's UI library.
-
-## Live Example
-
-
- {item}
-
- ))}
-
- {['flex-start', 'center', 'flex-end', 'space-between', 'space-around'].map(justify => (
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `vertical` | `boolean` | `false` | - |
-| `wrap` | `string` | `"nowrap"` | - |
-| `justify` | `string` | `"normal"` | - |
-| `align` | `string` | `"normal"` | - |
-| `flex` | `string` | `"normal"` | - |
-| `gap` | `string` | `"small"` | - |
-
-## Import
-
-```tsx
-import { Flex } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Flex/Flex.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/design-system/grid.mdx b/docs/developer_docs/components/design-system/grid.mdx
deleted file mode 100644
index a7fea3d3dc1..00000000000
--- a/docs/developer_docs/components/design-system/grid.mdx
+++ /dev/null
@@ -1,192 +0,0 @@
----
-title: Grid
-sidebar_label: Grid
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# Grid
-
-The Grid system of Ant Design is based on a 24-grid layout. The `Row` and `Col` components are used to create flexible and responsive grid layouts.
-
-## Live Example
-
-
- {justify}
-
-
-
-
-
-
- ))}
- col-12
-
- col-12
-
- col-8
-
- col-8
-
- col-8
-
-
- Responsive
-
-
-
- Responsive
-
-
-
- Responsive
-
-
-
- Responsive
-
-
-
-
-
-
-
-
-
-
-
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `align` | `string` | `"top"` | Vertical alignment of columns within the row. |
-| `justify` | `string` | `"start"` | Horizontal distribution of columns within the row. |
-| `wrap` | `boolean` | `true` | Whether columns are allowed to wrap to the next line. |
-| `gutter` | `number` | `16` | Spacing between columns in pixels. |
-
-## Import
-
-```tsx
-import { Grid } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Grid/Grid.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/design-system/index.mdx b/docs/developer_docs/components/design-system/index.mdx
deleted file mode 100644
index 03eb7f824fb..00000000000
--- a/docs/developer_docs/components/design-system/index.mdx
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: Layout Components
-sidebar_label: Layout Components
-sidebar_position: 1
----
-
-
-
-# Layout Components
-
-7 components available in this category.
-
-## Components
-
-- [DropdownContainer](./dropdowncontainer.mdx)
-- [Flex](./flex.mdx)
-- [Grid](./grid.mdx)
-- [Layout](./layout.mdx)
-- [MetadataBar](./metadatabar.mdx)
-- [Space](./space.mdx)
-- [Table](./table.mdx)
diff --git a/docs/developer_docs/components/design-system/layout.mdx b/docs/developer_docs/components/design-system/layout.mdx
deleted file mode 100644
index 1b0d76e0ad1..00000000000
--- a/docs/developer_docs/components/design-system/layout.mdx
+++ /dev/null
@@ -1,139 +0,0 @@
----
-title: Layout
-sidebar_label: Layout
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# Layout
-
-Ant Design Layout component with configurable Sider, Header, Footer, and Content.
-
-## Live Example
-
-start
- start
- center
- center
- end
- end
- between
- between
- Sidebar
- Right Sidebar
-
- {item}
-
- ))}
-
- {['small', 'middle', 'large'].map(size => (
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `direction` | `string` | `"horizontal"` | - |
-| `size` | `string` | `"small"` | - |
-| `wrap` | `boolean` | `false` | - |
-
-## Import
-
-```tsx
-import { Space } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Space/Space.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/design-system/table.mdx b/docs/developer_docs/components/design-system/table.mdx
deleted file mode 100644
index db0be495173..00000000000
--- a/docs/developer_docs/components/design-system/table.mdx
+++ /dev/null
@@ -1,311 +0,0 @@
----
-title: Table
-sidebar_label: Table
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# Table
-
-A data table component with sorting, pagination, row selection, resizable columns, reorderable columns, and virtualization for large datasets.
-
-## Live Example
-
-
-
- {items.map(item => (
-
-
- ))}
- {size}
-{item}
- ))}
- 
-
-## Usage
-
-All components are exported from `@superset-ui/core/components`:
-
-```tsx
-import { Button, Modal, Select } from '@superset-ui/core/components';
-```
-
-## Contributing
-
-This documentation is auto-generated from Storybook stories. To add or update component documentation:
-
-1. Create or update the component's `.stories.tsx` file
-2. Add a descriptive `title` and `description` in the story meta
-3. Export an interactive story with `args` for configurable props
-4. Run `yarn generate:superset-components` in the `docs/` directory
-
-:::info Work in Progress
-This component library is actively being documented. See the [Components TODO](./TODO.md) page for a list of components awaiting documentation.
-:::
-
----
-
-*Auto-generated from Storybook stories in the [Design System/Introduction](https://github.com/apache/superset/blob/master/superset-frontend/packages/superset-ui-core/src/components/DesignSystem.stories.tsx) story.*
diff --git a/docs/developer_docs/components/ui/autocomplete.mdx b/docs/developer_docs/components/ui/autocomplete.mdx
deleted file mode 100644
index 789883dbb4c..00000000000
--- a/docs/developer_docs/components/ui/autocomplete.mdx
+++ /dev/null
@@ -1,215 +0,0 @@
----
-title: AutoComplete
-sidebar_label: AutoComplete
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# AutoComplete
-
-AutoComplete component for search functionality.
-
-## Live Example
-
-
- {statuses.map(status => (
-
- );
-}
-```
-
-## Color Gallery
-
-```tsx live
-function ColorGallery() {
- const colors = ['pink', 'red', 'orange', 'green', 'cyan', 'blue', 'purple'];
- return (
-
- {colors.map(color => (
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `count` | `number` | `5` | Number to show in the badge. |
-| `size` | `string` | `"default"` | Size of the badge. |
-| `showZero` | `boolean` | `false` | Whether to show badge when count is zero. |
-| `overflowCount` | `number` | `99` | Max count to show. Shows count+ when exceeded (e.g., 99+). |
-
-## Import
-
-```tsx
-import { Badge } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Badge/Badge.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/ui/breadcrumb.mdx b/docs/developer_docs/components/ui/breadcrumb.mdx
deleted file mode 100644
index 5591b2e089f..00000000000
--- a/docs/developer_docs/components/ui/breadcrumb.mdx
+++ /dev/null
@@ -1,93 +0,0 @@
----
-title: Breadcrumb
-sidebar_label: Breadcrumb
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# Breadcrumb
-
-Breadcrumb component for displaying navigation paths.
-
-## Live Example
-
-
-
- Default card content.
-
-
- Hover over this card.
-
-
- This content is hidden while loading.
-
-
- Borderless card.
-
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `padded` | `boolean` | `true` | Whether the card content has padding. |
-| `title` | `string` | `"Dashboard Overview"` | Title text displayed at the top of the card. |
-| `children` | `string` | `"This card displays a summary of your dashboard metrics and recent activity."` | The content inside the card. |
-| `bordered` | `boolean` | `true` | Whether to show a border around the card. |
-| `loading` | `boolean` | `false` | Whether to show a loading skeleton. |
-| `hoverable` | `boolean` | `false` | Whether the card lifts on hover. |
-
-## Import
-
-```tsx
-import { Card } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Card/Card.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/ui/checkbox.mdx b/docs/developer_docs/components/ui/checkbox.mdx
deleted file mode 100644
index 13709c36130..00000000000
--- a/docs/developer_docs/components/ui/checkbox.mdx
+++ /dev/null
@@ -1,141 +0,0 @@
----
-title: Checkbox
-sidebar_label: Checkbox
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# Checkbox
-
-Checkbox component that supports both regular and indeterminate states, built on top of Ant Design v5 Checkbox.
-
-## Live Example
-
-
- Unchecked
- Checked
- Indeterminate
- Disabled unchecked
- Disabled checked
-
- );
-}
-```
-
-## Select All Pattern
-
-```tsx live
-function SelectAllDemo() {
- const [selected, setSelected] = React.useState([]);
- const options = ['Option A', 'Option B', 'Option C'];
-
- const allSelected = selected.length === options.length;
- const indeterminate = selected.length > 0 && !allSelected;
-
- return (
-
- setSelected(e.target.checked ? [...options] : [])}
- >
- Select All
-
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `checked` | `boolean` | `false` | Whether the checkbox is checked. |
-| `indeterminate` | `boolean` | `false` | Whether the checkbox is in indeterminate state (partially selected). |
-
-## Import
-
-```tsx
-import { Checkbox } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Checkbox/Checkbox.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/ui/collapse.mdx b/docs/developer_docs/components/ui/collapse.mdx
deleted file mode 100644
index 4e35c7b4353..00000000000
--- a/docs/developer_docs/components/ui/collapse.mdx
+++ /dev/null
@@ -1,106 +0,0 @@
----
-title: Collapse
-sidebar_label: Collapse
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# Collapse
-
-The Collapse component from Superset's UI library.
-
-## Live Example
-
-
- {options.map(opt => (
-
-
- setSelected(prev =>
- prev.includes(opt) ? prev.filter(x => x !== opt) : [...prev, opt]
- )}
- >
- {opt}
-
-
- ))}
- Horizontal divider with title (orientationMargin applies here):
-Vertical divider (use container gap for spacing):
-
- Link
-
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `dashed` | `boolean` | `false` | Whether line is dashed (deprecated, use variant). |
-| `variant` | `string` | `"solid"` | Line style of the divider. |
-| `orientation` | `string` | `"center"` | Position of title inside divider. |
-| `orientationMargin` | `string` | `""` | Margin from divider edge to title. |
-| `plain` | `boolean` | `true` | Use plain style without bold title. |
-| `type` | `string` | `"horizontal"` | Direction of the divider. |
-
-## Import
-
-```tsx
-import { Divider } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Divider/Divider.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/ui/editabletitle.mdx b/docs/developer_docs/components/ui/editabletitle.mdx
deleted file mode 100644
index bea676b0401..00000000000
--- a/docs/developer_docs/components/ui/editabletitle.mdx
+++ /dev/null
@@ -1,172 +0,0 @@
----
-title: EditableTitle
-sidebar_label: EditableTitle
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# EditableTitle
-
-The EditableTitle component from Superset's UI library.
-
-## Live Example
-
-
-
- );
-}
-```
-
-## Icon Sizes
-
-```tsx live
-function IconSizes() {
- const sizes = ['s', 'm', 'l', 'xl', 'xxl'];
- return (
-
- {sizes.map(size => (
-
- );
-}
-```
-
-## Icon Gallery
-
-```tsx live
-function IconGallery() {
- const Section = ({ title, children }) => (
-
-
- ))}
- {size}
-
-
- );
- return (
- {title}
- {children}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- );
-}
-```
-
-## Icon with Text
-
-```tsx live
-function IconWithText() {
- return (
-
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `iconSize` | `string` | `"xl"` | Size of the icons: s (12px), m (16px), l (20px), xl (24px), xxl (32px). |
-
-## Import
-
-```tsx
-import { Icons } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Icons/Icons.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/ui/icontooltip.mdx b/docs/developer_docs/components/ui/icontooltip.mdx
deleted file mode 100644
index 4d1fdde8699..00000000000
--- a/docs/developer_docs/components/ui/icontooltip.mdx
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: IconTooltip
-sidebar_label: IconTooltip
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# IconTooltip
-
-The IconTooltip component from Superset's UI library.
-
-## Live Example
-
-
-
-
-
-
-
-
-
-
- {['normal', 'floating', 'inline'].map(position => (
-
- );
-}
-```
-
-## Size and Opacity Showcase
-
-```tsx live
-function SizeShowcase() {
- const sizes = ['s', 'm', 'l'];
- return (
-
-
- ))}
- {position}
-
-
- );
-}
-```
-
-## Contextual Examples
-
-```tsx live
-function ContextualDemo() {
- return (
-
-
-
- ))}
-
- Size
- Normal
- Muted
- Usage
- {sizes.map(size => (
-
- {size.toUpperCase()} ({size === 's' ? '40px' : size === 'm' ? '70px' : '100px'})
-
-
-
-
-
-
- {size === 's' && 'Filter bars, inline'}
- {size === 'm' && 'Explore pages'}
- {size === 'l' && 'Full page loading'}
-
-
-
- );
-}
-```
-
-## Props
-
-| Prop | Type | Default | Description |
-|------|------|---------|-------------|
-| `size` | `string` | `"m"` | Size of the spinner: s (40px), m (70px), or l (100px). |
-| `position` | `string` | `"normal"` | Position style: normal (inline flow), floating (overlay), or inline. |
-| `muted` | `boolean` | `false` | Whether to show a muted/subtle version of the spinner. |
-
-## Import
-
-```tsx
-import { Loading } from '@superset-ui/core/components';
-```
-
----
-
-:::tip[Improve this page]
-This documentation is auto-generated from the component's Storybook story.
-Help improve it by [editing the story file](https://github.com/apache/superset/edit/master/superset-frontend/packages/superset-ui-core/src/components/Loading/Loading.stories.tsx).
-:::
diff --git a/docs/developer_docs/components/ui/menu.mdx b/docs/developer_docs/components/ui/menu.mdx
deleted file mode 100644
index c088eb538c7..00000000000
--- a/docs/developer_docs/components/ui/menu.mdx
+++ /dev/null
@@ -1,174 +0,0 @@
----
-title: Menu
-sidebar_label: Menu
----
-
-
-
-import { StoryWithControls } from '../../../src/components/StorybookWrapper';
-
-# Menu
-
-Navigation menu component supporting horizontal, vertical, and inline modes. Based on Ant Design Menu with Superset styling.
-
-## Live Example
-
-Filter Bar (size="s", muted)
-
- Filter 1:
-
-
- Dashboard Grid (size="s", muted)
-
- {[1, 2, 3].map(i => (
-
-
-
-
- ))}
- Main Loading (size="l")
-
-
-