{"record":{"id":"047616daeac65373","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-access-image-image-name","errorCode":null,"errorMessage":"Not authorized to access image {image_name}","messagePattern":"Not authorized to access image (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"invokeai/app/api/routers/recall_parameters.py","lineNumber":394,"sourceCode":"    if current_user.is_admin:\n        return\n\n    for image_name in image_names:\n        owner = ApiDependencies.invoker.services.image_records.get_user_id(image_name)\n        if owner is not None and owner == current_user.user_id:\n            continue\n\n        # Check board visibility\n        board_id = ApiDependencies.invoker.services.board_image_records.get_board_for_image(image_name)\n        if board_id is not None:\n            try:\n                board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)\n                if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):\n                    continue\n            except Exception:\n                pass\n\n        raise HTTPException(status_code=403, detail=f\"Not authorized to access image {image_name}\")\n\n\n@recall_parameters_router.post(\n    \"/{queue_id}\",\n    operation_id=\"update_recall_parameters\",\n    response_model=dict[str, Any],\n)\ndef update_recall_parameters(\n    current_user: CurrentUserOrDefault,\n    queue_id: str = Path(..., description=\"The queue id to perform this operation on\"),\n    parameters: RecallParameter = Body(..., description=\"Recall parameters to update\"),\n    strict: bool = Query(\n        default=False,\n        description=\"When true, parameters not included in the request are reset to their defaults (cleared).\",\n    ),\n    append: bool = Query(\n        default=False,\n        description=(","sourceCodeStart":376,"sourceCodeEnd":412,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/recall_parameters.py#L376-L412","documentation":"HTTP 403 raised by the recall-parameters endpoints when the authenticated user is not permitted to access the requested image. The check ensures users cannot probe image existence/leak dimensions or mint derived images (e.g. via ControlNet preprocessors) for images they don't own or that aren't on a shared/public board.","triggerScenarios":"POST /api/v1/recall_parameters/{queue_id} referencing an image_name the user doesn't own, where the image's board (if any) is not Shared or Public board visibility.","commonSituations":"Sharing a workflow/queue between users whose images are private; recalling parameters from another user's image; images moved to a private board after the reference was created.","solutions":["Use an image the current user owns, or one on a Shared/Public board","Ask the image owner to share its board or move the image to a shared/public board","Remove the inaccessible image_name from the recall request's reference list","Check board visibility (board_visibility Shared/Public) before recalling"],"exampleFix":"// before\nconst images = await Promise.all(names.map(n => api.recallParameters(queueId, { image_names: [n] })));\n// after\nconst accessible = [];\nfor (const n of names) {\n  try { const img = await api.getImageDto(n); accessible.push(img); } catch { /* skip 403 */ }\n}\nawait api.recallParameters(queueId, { image_names: accessible.map(i => i.image_name) });","handlingStrategy":"validation","validationCode":"const dto = await api.getImageDto(imageName); // throws 403 early if inaccessible\nconst board = dto.board_id ? await api.getBoard(dto.board_id) : null;\nconst accessible = !board || ['shared', 'public'].includes(board.board_visibility);\nif (!accessible) throw new Error(`Skipping inaccessible image ${imageName}`);","typeGuard":"function isBoardAccessible(board) {\n  return board == null || board.board_visibility === 'shared' || board.board_visibility === 'public';\n}","tryCatchPattern":"try {\n  await api.recallParameters(queueId, { image_names: [name] });\n} catch (e) {\n  if (e.status === 403) {\n    console.warn(`No access to image ${name}; skipping`);\n  } else throw e;\n}","preventionTips":["Only reference images owned by the current user or on shared/public boards","Pre-check image DTOs before batch recall to skip inaccessible ones","Update stale references after images are moved to private boards","In multi-user setups, prefer shared boards for workflow sharing"],"tags":["http-403","authorization","image-access"],"backgroundTag":"forbidden-resource-access","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}