{"record":{"id":"2f8f347d4f6e6cdc","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-update-this-system-prompt","errorCode":null,"errorMessage":"Not authorized to update this system prompt","messagePattern":"Not authorized to update this system prompt","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"invokeai/app/api/routers/system_prompts.py","lineNumber":91,"sourceCode":"@system_prompts_router.patch(\n    \"/i/{system_prompt_id}\",\n    operation_id=\"update_system_prompt\",\n    responses={200: {\"model\": SystemPromptRecordDTO}},\n)\ndef update_system_prompt(\n    current_user: CurrentUserOrDefault,\n    system_prompt_id: str = Path(description=\"The id of the system prompt to update\"),\n    changes: SystemPromptChanges = Body(description=\"The changes to apply\"),\n) -> SystemPromptRecordDTO:\n    \"\"\"Updates a system prompt. Only the owner or an admin may update.\"\"\"\n    config = ApiDependencies.invoker.services.configuration\n    if config.multiuser:\n        try:\n            existing = ApiDependencies.invoker.services.system_prompt_records.get(system_prompt_id)\n        except SystemPromptNotFoundError:\n            raise HTTPException(status_code=404, detail=\"System prompt not found\")\n        if not current_user.is_admin and existing.user_id != current_user.user_id:\n            raise HTTPException(status_code=403, detail=\"Not authorized to update this system prompt\")\n    user_id = None if current_user.is_admin else current_user.user_id\n    try:\n        return ApiDependencies.invoker.services.system_prompt_records.update(system_prompt_id, changes, user_id=user_id)\n    except SystemPromptNotFoundError:\n        raise HTTPException(status_code=404, detail=\"System prompt not found\")\n\n\n@system_prompts_router.delete(\n    \"/i/{system_prompt_id}\",\n    operation_id=\"delete_system_prompt\",\n)\ndef delete_system_prompt(\n    current_user: CurrentUserOrDefault,\n    system_prompt_id: str = Path(description=\"The id of the system prompt to delete\"),\n) -> None:\n    \"\"\"Deletes a system prompt. Only the owner or an admin may delete.\"\"\"\n    config = ApiDependencies.invoker.services.configuration\n    if config.multiuser:","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/system_prompts.py#L73-L109","documentation":"HTTP 403 raised in update_system_prompt when multiuser mode is on and the authenticated user is not an admin and not the owner (existing.user_id != current_user.user_id). Enforced at invokeai/app/api/routers/system_prompts.py:91 before attempting the update.","triggerScenarios":"PUT/PATCH /system_prompts/i/{system_prompt_id} with config.multiuser=true, prompt exists, but the caller's user_id differs from existing.user_id and the caller lacks is_admin.","commonSituations":"Two users in a shared InvokeAI instance trying to edit each other's prompts; service account token used instead of the owner's token; user assumed admin privileges they don't have.","solutions":["Log in as the prompt owner or use an admin token","Have an admin perform the update","Copy the prompt, modify the copy, and create it under your own account","Disable multiuser mode if per-user isolation is not desired"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"const target = await api.getSystemPrompt(id); // may itself 403/404\nif (target.user_id !== currentUser.user_id && !currentUser.is_admin) {\n  throw new Error('Current user cannot update this prompt');\n}","typeGuard":"function canUpdatePrompt(prompt, user) {\n  return user.is_admin === true || prompt.user_id === user.user_id;\n}","tryCatchPattern":"null","preventionTips":["Only expose edit/delete controls for prompts the current user owns","Use admin credentials for administrative bulk edits","Copy prompts to your own account before modifying them"],"tags":["http-403","authorization","multiuser","fastapi"],"backgroundTag":"http-403-forbidden","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}