Dataset API returns empty results ([]) despite user owning datasets (Superset 6.1.0rc1)

[hallebanis]

When calling the Superset Dataset API (/api/v1/dataset/) using a Bearer token, the response returns 200 OK with an empty result set (result: []), even though the authenticated user is the owner of existing datasets.

The same user can see the datasets correctly in the Superset UI.

Steps to Reproduce
Authenticate using a Bearer token
Call the dataset API:
GET /api/v1/dataset/?q=(order_column:changed_on_delta_humanized,order_direction:desc,page:0,page_size:25)
Authorization: Bearer
Observe the response
Actual Result
{
"result": []
}
Expected Result

Datasets owned by the authenticated user should be returned, consistent with what is visible in the UI.

Logs

2026-04-21 13:48:43


2026-04-21 11:48:43,263:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
2026-04-21 13:48:43


2026-04-21 11:48:43,266:INFO:werkzeug:172.18.0.1 - - [21/Apr/2026 11:48:43] "GET /api/v1/dataset/?q=(order_column:changed_on_delta_humanized,order_direction:desc,page:0,page_size:25) HTTP/1.1" 200 

Environment
Superset version: 6.1.0rc1
Deployment: Docker
Authentication method: Bearer token

[dosubot[bot]]

Hi @hallebanis! I'm Dosu and I’m helping the superset team.

@hallebanis This is a frequently reported issue — the Dataset API returns empty results because Bearer tokens alone don't establish the session cookies that Superset's authorization filters require. The token authenticates you (hence the 200 OK), but the DatasourceFilter can't resolve your permissions without a proper session, so it silently returns zero results instead of an error [1] [2].

The fix is to use a requests.Session() and call the CSRF token endpoint with your Authorization header before making API calls. This establishes the session cookies:

import requests

session = requests.Session()

# 1. Login
login_resp = session.post(
    "http://localhost:8088/api/v1/security/login",
    json={"username": "admin", "password": "admin", "provider": "db"}
)
access_token = login_resp.json()["access_token"]

# 2. Get CSRF token (this establishes the session cookie)
session.headers.update({"Authorization": f"Bearer {access_token}"})
csrf_resp = session.get("http://localhost:8088/api/v1/security/csrf_token/")
csrf_token = csrf_resp.json()["result"]
session.headers.update({"X-CSRFToken": csrf_token})

# 3. Now API calls will return results
resp = session.get("http://localhost:8088/api/v1/dataset/?q=(order_column:changed_on_delta_humanized,order_direction:desc,page:0,page_size:25)")
print(resp.json())

Key points:

• Using requests.Session() is critical — it automatically manages cookies across requests [2].
• The Authorization header must be included when calling the CSRF token endpoint, otherwise the session won't be tied to your user [3].
• Also check that your Public role doesn't have can read on Dashboard or can read on Chart permissions — these can interfere with token-based auth and cause authenticated users to be treated as anonymous [1].

Regarding the "Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped" warning — this is a separate logging-related issue that was fixed in PR #33025. It shouldn't directly cause empty results, but it does indicate the user context isn't fully established during that request, which is consistent with the missing session cookie problem.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.