Issue Summary
POST /api/widgets raises an unhandled KeyError (surfaced as HTTP 500) when the request body omits the visualization_id key — which is the natural shape for a text-only widget, since that field doesn't apply to text widgets.
Steps to Reproduce
POST /api/widgets with {"dashboard_id": <id>, "width": 1, "text": "hello"} (no visualization_id key) → 500 Internal Server Error.- Same request with
"visualization_id": null added → 201, text widget created successfully.
Why this is a bug: in redash/handlers/widgets.py, WidgetListResource.post() pops id with a fallback default but pops visualization_id with none:
widget_properties.pop("id", None) # safe
visualization_id = widget_properties.pop("visualization_id") # unsafe: no defaultvisualization_id is documented as optional ("The ID of the visualization to put in this widget"), so any client that omits the key entirely — rather than sending it explicitly as null — hits an unhandled KeyError before the if visualization_id: branch is ever reached. I expected a validation error or successful text-widget creation, not a 500.
Suggested one-line fix: widget_properties.pop("visualization_id", None).
Found while debugging a client (@suthio/redash-mcp) that omitted the key for text widgets — see suthio/redash-mcp#99 / suthio/redash-mcp#100 for the client-side writeup and patch. That client now always sends an explicit null, but this is a server-side robustness gap independent of any specific client, and I'd expect other API consumers to hit it the same way.
Technical details:
- Redash Version: 25.8.0 (67a95e9)
- Browser/OS: N/A — server-side REST API bug (
POST /api/widgets), not browser-specific
- How did you install Redash: N/A (not disclosing internal deployment details)
Issue Summary
POST /api/widgetsraises an unhandledKeyError(surfaced as HTTP 500) when the request body omits thevisualization_idkey — which is the natural shape for a text-only widget, since that field doesn't apply to text widgets.Steps to Reproduce
POST /api/widgetswith{"dashboard_id": <id>, "width": 1, "text": "hello"}(novisualization_idkey) → 500 Internal Server Error."visualization_id": nulladded → 201, text widget created successfully.Why this is a bug: in
redash/handlers/widgets.py,WidgetListResource.post()popsidwith a fallback default but popsvisualization_idwith none:visualization_idis documented as optional ("The ID of the visualization to put in this widget"), so any client that omits the key entirely — rather than sending it explicitly asnull— hits an unhandledKeyErrorbefore theif visualization_id:branch is ever reached. I expected a validation error or successful text-widget creation, not a 500.Suggested one-line fix:
widget_properties.pop("visualization_id", None).Found while debugging a client (
@suthio/redash-mcp) that omitted the key for text widgets — see suthio/redash-mcp#99 / suthio/redash-mcp#100 for the client-side writeup and patch. That client now always sends an explicitnull, but this is a server-side robustness gap independent of any specific client, and I'd expect other API consumers to hit it the same way.Technical details:
POST /api/widgets), not browser-specific