There was an error loading permissions.

[stockarea]

Bug description

I am going to the List Roles.

Then trying to clicking the permissions to select or deselect and getting this error.

this is my curl request

Request URL
https://dashboard.stockarea.io/api/v1/security/permissions-resources/?q=(filters:!((col:id,opr:in,value:!(3,7,11,15,17,46,47,343,52,54,65,66,68,70,77,137,138,340,352,8,16,344,51,53,67,69,76,342,23,24,27,255,43,85,128,361,108,45,87,130,359,254,131,360,256,132,358,253,133,357,33,42,44,103,48,50,56,341,57,58,78,129,92,93,94,101,105,106,107,109,112,113,114,115,116,117,134,135,364,160,163,164,165,167,168,252,257,258,259,345,346,347,349,353,354))),page:0,page_size:100)
Request Method
GET
Status Code
400 Bad Request
Remote Address
[2606:4700:8391:50cb:f9e:0:f618:7dc2]:443
Referrer Policy
strict-origin-when-cross-origin

this is the response:
{
"message": "Filter column: id not allowed to filter"
}

Screenshots/recordings

Screencast.from.2026-05-20.20-32-46.mp4

Superset version

master / latest-dev

Python version

3.9

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

This is a duplicate of #39967 — the root cause is in Flask-AppBuilder (Superset's upstream dependency), not Superset itself. The PermissionViewMenuApi class in FAB doesn't declare search_columns, so filtering by id, permission.name, or view_menu.name returns 400 "Filter column: id not allowed to filter" [1].

Workaround: Override PermissionViewMenuApi in your Superset deployment:

from flask_appbuilder.models.sqla.filters import FilterContains
from flask_appbuilder.security.sqla.apis import PermissionViewMenuApi

class SupersetPermissionViewMenuApi(PermissionViewMenuApi):
    search_columns = ["id", "permission.name", "view_menu.name"]

    def _init_properties(self) -> None:
        super()._init_properties()
        for col in ["permission.name", "view_menu.name"]:
            self._filters._search_filters[col] = [
                FilterContains(col, self.datamodel)
            ]

Then wire it via SupersetSecurityManager.permission_view_menu_api = SupersetPermissionViewMenuApi [1].

Until this is fixed upstream in FAB or Superset adds an official override, this workaround should unblock you.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[nikefeel]

from flask_appbuilder.models.sqla.filters import FilterContains
from flask_appbuilder.security.sqla.apis import PermissionViewMenuApi
from superset.security import SupersetSecurityManager

class SupersetPermissionViewMenuApi(PermissionViewMenuApi):
    search_columns = ["id", "permission.name", "view_menu.name"]

    def _init_properties(self) -> None:
        super()._init_properties()
        for col in ["permission.name", "view_menu.name"]:
            self._filters._search_filters[col] = [
                FilterContains(col, self.datamodel)
            ]

class CustomSecurityManager(SupersetSecurityManager):
    permission_view_menu_api = SupersetPermissionViewMenuApi

CUSTOM_SECURITY_MANAGER = CustomSecurityManager

without rebuild image. works for me