MapBox charts returns 404.

[kdemirov]

Bug description

Hello Everyone,

I hope you are doing okay, we are using superset for displaying charts into react application and loopback backend, in local environment everything works fine, the maps are shown in superset frontend also in react application. But in production it works for every charts expect for type MapBox and i tried using several, for example /api/v1/chart/27 not found on superset log also not found no other errors i check in database the charts exists with the appropriate id and it's connected to the dashboard. The permission can read on Chart can read on Dataset can read on Database, can query on Api, can explore json on Superset are all set and we don't know what might be the issue. Any help will be appreciated.

Screenshots/recordings

No response

Superset version

4.1.2 version

Python version

3.11

Node version

18 or greater

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

Hi @kdemirov! I'm Dosu and I’m helping the superset team.

For MapBox charts returning a 404 in production but working locally, here are the most likely causes and steps to troubleshoot:

1. MAPBOX_API_KEY not set in production: The MapBox chart requires a valid API key. In Superset, this is configured via the MAPBOX_API_KEY environment variable. If this is missing or empty in your production .env or environment configuration, MapBox charts will fail to load. Double-check that your production environment has a valid MapBox API key set (not just locally) and that it is accessible to the Superset process. See here and here.

2. Content Security Policy (CSP) restrictions: Production environments often have stricter CSP settings. MapBox charts need to connect to https://api.mapbox.com and https://events.mapbox.com. If your CSP does not allow these domains in connect-src, MapBox resources will be blocked, resulting in errors or missing maps. You can adjust CSP settings in Superset using superset_config.py and Talisman. See the security docs.

3. Network or firewall issues: Ensure your production server can reach MapBox endpoints. Firewalls, proxies, or outbound network restrictions can block these requests, causing failures that may not appear in Superset logs.

4. API key usage limits or invalid key: If your API key is invalid or has exceeded its usage limits, MapBox will return errors. Make sure the key is valid and has sufficient quota.

5. No errors in Superset logs: Since you see no errors in the logs and the chart exists in the database, the issue is almost certainly environmental (API key, CSP, or network).

Action steps:

• Confirm MAPBOX_API_KEY is set and non-empty in your production environment.
• Check your CSP settings to ensure https://api.mapbox.com and https://events.mapbox.com are allowed.
• Verify network connectivity from your production server to MapBox endpoints.
• Make sure your API key is valid and not rate-limited.

If you address these areas and the issue persists, please share any browser console errors or network request failures you see when loading a MapBox chart in production. This can help pinpoint whether the problem is with the frontend, backend, or network configuration.

To reply, just mention my name @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[sfirke]

I don't have expertise on embedded but will say I have public-facing Mapbox charts working fine in production running Superset 4.1.2. What do you think of Dosu's suggestions? That's where I would start too on this one.

[rusackas]

I was betting on the first suggestion the bot made, but let us know if it is (or we are) mistaken!

[kdemirov]

@dosubot @rusackas @sfirke I tried all the suggestion from dosu used new public api key, created CSP for allowing api.mapbox but not with taslisman, talistman is disabled with http_headers, i verified the connvectivity from my production server to mapbox endpoints, and still same issue. log [29/May/2025:07:31:25 +0000] "GET /api/v1/chart/27 HTTP/1.0" 404 24 "https://example.com/embedded/ab13a66a-9bda-46cb-9a6e-5d240762a2db?uiConfig=11" 6 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36". Although i forgot to mention in superset is working the map only in react application it returns 404?

[dosubot]

Based on your description and the research into recent Superset changes, here are the most likely causes and next steps for the persistent 404 error on /api/v1/chart/27 for MapBox charts in production:

1. Embedded Chart Domain Restrictions: Superset now enforces allowed domains for embedded charts. If your production domain is not explicitly allowed, embedded chart API requests (like /api/v1/chart/27) can return a 404 even if the chart exists and permissions are correct. Make sure your production domain is included in the allowed domains configuration for embedded Superset charts. See the relevant change here.

2. Embedded Feature Flag: Ensure that SUPERSET_FEATURE_EMBEDDED_SUPERSET=true is set in your production .env file. This enables embedded chart functionality, which is required for embedded chart endpoints to work as expected. See the documentation here.

3. CSRF and Feature Flags: Double-check that your CSRF settings are correct. Recommended settings are WTF_CSRF_ENABLED = True, WTF_CSRF_EXEMPT_LIST = [], and WTF_CSRF_TIME_LIMIT = 60*60*24*365. Also, ensure FEATURE_FLAGS includes both DASHBOARD_CACHE: True and EMBEDDED_SUPERSET: True source.

4. API Endpoint Changes: There have been recent changes to API endpoints and embedded dashboard configuration. If your production environment is not fully up-to-date or has mismatched frontend/backend versions, this could cause 404s for certain endpoints. Make sure both frontend and backend are running the same Superset version and all migrations have been applied.

5. Browser Console and Network Tab: Since the logs show a 404 but no other errors, check the browser console and network tab for failed requests or CORS errors when loading the embedded MapBox chart. This can help pinpoint if the request is being blocked or misrouted.

If you have confirmed all the above and the issue persists, please share any errors from the browser console or network tab when you attempt to load the MapBox chart in production. This will help further isolate whether the problem is with Superset's backend, the embedding configuration, or the frontend request.

To reply, just mention my name @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[kdemirov]

@dosu this is my network error 27 | 404 | fetch | callApi.ts:113
All other charts are loaded only the mapbox is returning this error.

[dosubot]

The 404 error from your network request to /api/v1/chart/27 indicates that Superset cannot find the chart or its required resources in production, even though it works locally. Based on the Superset code and recent updates, this can happen if:

• The chart with ID 27 does not exist in the production database, or its datasource is missing or misconfigured. The endpoint will return a 404 if either the chart or its datasource cannot be found or loaded [source].
• There are permission issues or missing roles after recent API changes. Superset migrated from /superset/slice_json/<id> to /api/v1/chart/<id>/data/, and permissions must be updated accordingly. Ensure your production roles have can read on Chart [source].
• The query context for the chart is missing or corrupted in production. If the chart’s saved query context cannot be loaded, the API will not return data [source].
• The frontend and backend versions are mismatched, or migrations are incomplete, which can cause endpoints to fail.

Since you confirmed the chart exists in the database, double-check that its datasource (table or dataset) also exists and is accessible in production. Try opening the chart directly in the Superset UI in production—if it fails there, the issue is with the chart or datasource, not embedding.

If you recently upgraded or changed your Superset deployment, ensure all database migrations have run and that your roles/permissions are up to date. If you have custom roles, verify that they include the new permissions for chart access.

If you can, inspect the Superset server logs right after the 404 occurs for any traceback or error message related to chart or datasource lookup. This can help pinpoint if it’s a missing chart, missing datasource, or a permissions/configuration issue.

Let me know if you find any error messages in the logs or if the chart fails to load in the Superset UI itself. That will help narrow down the root cause.

To reply, just mention my name @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}