{"record":{"id":"372ac761253c1876","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-access-this-board-372ac7","errorCode":null,"errorMessage":"Not authorized to access this board","messagePattern":"Not authorized to access this board","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/boards.py","lineNumber":84,"sourceCode":"    current_user: CurrentUserOrDefault,\n    board_id: str = Path(description=\"The id of board to get\"),\n) -> BoardDTO:\n    \"\"\"Gets a board (user must have access to it)\"\"\"\n\n    try:\n        result = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)\n    except Exception:\n        raise HTTPException(status_code=404, detail=\"Board not found\")\n\n    # Admins can access any board.\n    # Owners can access their own boards.\n    # Shared and public boards are visible to all authenticated users.\n    if (\n        not current_user.is_admin\n        and result.user_id != current_user.user_id\n        and result.board_visibility == BoardVisibility.Private\n    ):\n        raise HTTPException(status_code=403, detail=\"Not authorized to access this board\")\n\n    return result\n\n\n@boards_router.patch(\n    \"/{board_id}\",\n    operation_id=\"update_board\",\n    responses={\n        201: {\n            \"description\": \"The board was updated successfully\",\n        },\n    },\n    status_code=201,\n    response_model=BoardDTO,\n)\ndef update_board(\n    current_user: CurrentUserOrDefault,\n    board_id: str = Path(description=\"The id of board to update\"),","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/boards.py#L66-L102","documentation":"HTTP 403 returned by GET /boards/{board_id} after the board is found but the access check fails: the requester is not an admin, is not the board's owner, and the board's visibility is Private. This is a multi-user access-control error, not a data-missing error.","triggerScenarios":"GET /boards/{board_id} authenticated as a non-admin user who does not own the board and where board DTO has board_visibility == 'Private'.","commonSituations":"Sharing board URLs between users on a multi-user InvokeAI deployment, token/auth confusion causing requests under the wrong user, or boards created as Private by default.","solutions":["Log in as the board owner or an admin account","Have the owner change the board's visibility via PATCH /boards/{board_id} (set Shared/Public)","Verify you are authenticated as the intended user (check current user endpoint / token)","If access should be allowed, confirm the deployment's user setup/roles"],"exampleFix":"// before\nawait api.get(`/boards/${boardId}`);\n// after\n// owner flips visibility first:\nawait api.patch(`/boards/${boardId}`, { board_visibility: 'Shared' });\nconst board = await api.get(`/boards/${boardId}`);","handlingStrategy":"try-catch","validationCode":"const board = await api.get(`/boards/${boardId}`).catch(() => null); // 403 throws here if private\nif (board === null) console.warn('no access to board', boardId);","typeGuard":"const isForbidden = (e) => e?.response?.status === 403;","tryCatchPattern":"try {\n  return await api.get(`/boards/${boardId}`);\n} catch (e) {\n  if (isForbidden(e)) {\n    console.error(`Board ${boardId} is Private and you are not owner/admin`);\n    return null;\n  }\n  throw e;\n}","preventionTips":["Check board visibility/user_id before sharing board links","Use the owner's or an admin's credentials for private boards","Set board_visibility to 'Shared'/'Public' when collaboration is intended","Verify which user your auth token resolves to"],"tags":["http-403","authorization","multi-user","boards"],"backgroundTag":"permission-denied","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}