Issue when trying get dataset using API

[Ametist2502]

Description
I’m having an issue when calling the GET /api/v1/dataset endpoint.
When I run it on Swagger UI, it works correctly and returns data.
However, when I call it using Python’s requests library, the API response shows count = 0.

Steps to Reproduce

Call the login API to get the access token

Call the CSRF API to get the CSRF token and cookies

Call /api/v1/dataset using the GET method

Expected Behavior
The API should return the same dataset result as when called from Swagger UI.

Actual Behavior
The API call returns count = 0.

Environment

Superset version: 4.1.3

Python version: 3.9

Additional Context
Any help would be appreciated. Thanks!

[dosubot[bot]]

Hi @Ametist2502! I'm Dosu and I’m helping the superset team.

This usually happens when the Python requests session is missing some authentication context that Swagger UI handles automatically. For the /api/v1/dataset endpoint, Superset requires not just the access token, but also the correct session cookies and, in some cases, the CSRF token—even for GET requests, depending on your configuration.

Swagger UI uses your browser's session, so it always has the right cookies and tokens. With Python requests, you need to make sure you:

1. Use a requests.Session() object to persist cookies across requests.
2. After logging in and getting the access token, save all cookies set by the server.
3. When calling /api/v1/dataset, include:
   • The Authorization header: Bearer <access_token>
   • The CSRF token in the X-CSRFToken header (if required)
   • All cookies from the login and CSRF requests

If any of these are missing or mismatched, Superset will treat your session as unauthorized or lacking permissions, and the dataset query will be filtered down to zero results by the security layer (see code reference, security details).

Double-check that your Python requests code is copying all cookies and headers from the login and CSRF steps into the dataset request. If you’re already doing this, compare the request details (headers, cookies, query params) between Swagger UI (using browser dev tools) and your Python code to spot any differences. That should help you get matching results.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[dosubot[bot]]

If you're still getting count = 0 even after passing the CSRF token and cookies from /security/csrf-token, it's likely that your Python request is missing the Authorization header with a valid Bearer token, or the session context isn't matching what Swagger UI/browser uses. Superset's API requires all three: the Authorization header, session cookies, and CSRF token. If any are missing or don't match, Superset's security layer will silently filter out all datasets and return count = 0 as a security feature, instead of an error see code reference.

Double-check that:

• You're including the Authorization: Bearer <access_token> header in both the CSRF token request and the dataset request see example.
• You're using a persistent session (like requests.Session()) to maintain cookies across requests.
• All cookies and the CSRF token from the /security/csrf-token response are included in the /api/v1/dataset request.

If all of these are correct, compare the full request headers and cookies between your browser (Swagger UI) and your Python code to spot any differences. Even a small mismatch can cause Superset to treat the session as unauthorized and return zero results.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[Ametist2502]

This is my script.
session = requests.Session()

headers = {
"Authorization": "Bearer ",
"X-CSRFToken": "",
"Cookie": "session=<session_key>"
}

response = session.request(method, prod_get_dataset_url, headers=headers)
print(response.content)

[dosubot[bot]]

The main issue is that you're manually setting the Cookie header while also using requests.Session(). This can override or conflict with the session's internal cookie handling, which often leads to authentication problems and causes Superset to return count = 0 as a security measure example.

Instead, let requests.Session() manage cookies automatically. Here’s a recommended flow:

import requests

session = requests.Session()

# 1. Login to get the access token (and set initial cookies)
login_resp = session.post(
    "https://your-superset/api/v1/security/login",
    json={"username": "your_user", "password": "your_pass", "provider": "db"}
)
access_token = login_resp.json()["access_token"]
session.headers.update({"Authorization": f"Bearer {access_token}"})

# 2. Get CSRF token (session will handle cookies)
csrf_resp = session.get("https://your-superset/api/v1/security/csrf_token/")
csrf_token = csrf_resp.json()["result"]
session.headers.update({"X-CSRFToken": csrf_token})

# 3. Call the dataset API (no need to set Cookie header manually)
resp = session.get("https://your-superset/api/v1/dataset/")
print(resp.json())

Make sure you use the same session object for all steps so cookies and headers persist. Do not set the Cookie header manually—let the session handle it. This approach matches what Swagger UI does in the browser and should return the expected datasets reference.

If you still get count = 0, double-check that your user has dataset access and compare your request headers/cookies to those in Swagger UI using browser dev tools.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[Ametist2502]

i run script you give me but response of it return like below
{'count': 0, 'description_columns': {}, 'ids': [], 'label_columns': {'catalog': 'Catalog', 'changed_by.first_name': 'Changed By First Name', 'changed_by.id': 'Changed By Id', 'changed_by.last_name': 'Changed By Last Name', 'changed_by_name': 'Changed By Name', 'changed_on_delta_humanized': 'Changed On Delta Humanized', 'changed_on_utc': 'Changed On Utc', 'database.database_name': 'Database Database Name', 'database.id': 'Database Id', 'datasource_type': 'Datasource Type', 'default_endpoint': 'Default Endpoint', 'description': 'Description', 'explore_url': 'Explore Url', 'extra': 'Extra', 'id': 'Id', 'kind': 'Kind', 'owners.first_name': 'Owners First Name', 'owners.id': 'Owners Id', 'owners.last_name': 'Owners Last Name', 'schema': 'Schema', 'sql': 'Sql', 'table_name': 'Table Name', 'uuid': 'Uuid'}, 'list_columns': ['id', 'database.id', 'database.database_name', 'changed_by_name', 'changed_by.first_name', 'changed_by.last_name', 'changed_by.id', 'changed_on_utc', 'changed_on_delta_humanized', 'default_endpoint', 'description', 'datasource_type', 'explore_url', 'extra', 'kind', 'owners.id', 'owners.first_name', 'owners.last_name', 'catalog', 'schema', 'sql', 'table_name', 'uuid'], 'list_title': 'List Sqla Table', 'order_columns': ['table_name', 'catalog', 'schema', 'changed_by.first_name', 'changed_on_delta_humanized', 'database.database_name'], 'result': []}

[dosubot[bot]]

If your Python script returns count = 0 but Swagger UI shows datasets, it's almost always due to a difference in authentication/session context or user permissions. Superset requires the correct session cookie, CSRF token, and Authorization header for API access—if any are missing or mismatched, the API will silently return zero results, even for admin users example.

Make sure:

• The user account used in your Python script has the same roles and dataset access as the one in Swagger UI.
• You let requests.Session() manage cookies automatically and do not manually set the Cookie header.
• The Authorization header is present for all requests, including CSRF token retrieval example.

If all of this checks out, compare the full request headers and cookies between Swagger UI (using browser dev tools) and your Python code. Even a small difference can cause Superset to filter out all datasets discussion.

Also, check if your organization uses custom RBAC or security manager settings that might affect API results. If you still get empty results, try logging in via the browser, copying the session cookie, and using it in your Python request as a test—if that works, it's definitely a session/cookie issue example.

Let me know if you want help comparing request details or debugging user permissions.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}