403004 Error Returned Using Rest API

Published: 12 Aug 2022
Last Modified Date: 15 Aug 2022


When using Rest API to delete permissions to particular workbooks and data sources at top-level projects, a '403004 - User does not have permission for action - LOCKED_CHILD_PROJECT_CANNOT_BE_CHANGED' error is returned.

+ Using Rest API to delete similar permissions at other projects works successfully.

+ There are no child projects in use.

+ With the same user account, deleting these same permissions in the browser directly—rather than through using Rest API—works fine.


  • Tableau Server 2021.4.3


Option 1

Use the following steps to work around this behavior:

A) Check the user account and access that will be needed for the step 'B' below.

1. To confirm the admin user run:  tsm configuration get -k pgsql.adminusername
2. To confirm the port number run:  tsm configuration get -k  pgsql.port 
3. To get the Admin password run:  tsm configuration get -k pgsql.adminpassword

B) Logged in with the appropriate user login, run the following script:

UPDATE projects

SET controlling_permissions_project_id = NULL

WHERE (controlling_permissions_project_id = id AND parent_project_id IS NULL)

C) Test again to see if the permissions can be deleted with Rest API.

Option 2

Test the same steps using a Tableau Server version released after 5/13/2022. For example:


There was a known issue related to the Issue IDs 1358322 & 1349606 that has been fixed in more recent maintenance releases.

Additional Information

Part of the error message returned from the failed Rest API may appear similar to the following:
<error code="403004"><summary>Forbidden</summary><detail>User does not have permission for action.(LOCKED_CHILD_PROJECT_CANNOT_BE_CHANGED"</detail></error></tsResponse>
Did this article resolve the issue?