fix(alerts): return 400 instead of 500 when creating alert with unsupported dataset

[billyvg]

Summary

Fixes SENTRY-5PEF — KeyError: <Dataset.Sessions: 'sessions'> in snuba_query_validator.py

Root cause: When a user POSTs to /api/0/organizations/{org}/alert-rules/ with dataset=sessions (or any dataset absent from query_datasets_to_type), the dict lookup on line 321 raises an unhandled KeyError that propagates as a 500.

Dataset.Sessions was removed from query_datasets_to_type (which now only contains Events, Transactions, PerformanceMetrics, Metrics, and EventsAnalyticsPlatform), but external API clients still send dataset=sessions. This has been happening since at least 2026-05-06 with 8 unique users affected.

Fix: Add an explicit dataset not in query_datasets_to_type check that raises a serializers.ValidationError (→ HTTP 400) with a message listing the valid datasets, before the dict lookup that was previously crashing.

Evidence:

• Sentry issue: https://sentry.sentry.io/issues/SENTRY-5PEF
• Stacktrace: sentry/snuba/snuba_query_validator.py:321 in _validate_query — query_datasets_to_type[dataset] raises KeyError when dataset is Dataset.Sessions
• The fix converts a 500 (unhandled exception) to a 400 (proper validation error)

Test plan

• Added test_invalid_dataset_sessions_returns_validation_error to tests/sentry/snuba/test_validators.py covering the exact failing case
• Existing SnubaQueryValidatorTest tests continue to pass

Claude session: https://claude.ai/code/session_01LjN9gb92hUE6jTqQ9dkjAm

Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.

---

Generated by Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 483e8b3. Configure here.}

[cursor]

Error lists unusable dataset names

Low Severity

The new validation error builds its allowed-dataset list from enum .name.lower() values, but the API accepts dataset .value strings. For PerformanceMetrics and EventsAnalyticsPlatform, those differ (performancemetrics vs generic_metrics, eventsanalyticsplatform vs events_analytics_platform), so the 400 response advertises identifiers clients cannot submit. Field-level validate_dataset already lists .value correctly.

 

^{Reviewed by Cursor Bugbot for commit 483e8b3. Configure here.}