{"record":{"id":"46ff07229a8dd60c","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-modify-this-board-46ff07","errorCode":null,"errorMessage":"Not authorized to modify this board","messagePattern":"Not authorized to modify this board","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/videos.py","lineNumber":145,"sourceCode":"def _assert_board_write_access(board_id: str, current_user: CurrentUserOrDefault) -> None:\n    \"\"\"Raise 403 if the current user may not mutate the given board.\n\n    Mirrors _assert_board_write_access in board_images.py: admins and the board owner\n    may write; public boards accept contributions from any user.\n    \"\"\"\n    from invokeai.app.services.board_records.board_records_common import BoardVisibility\n\n    try:\n        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)\n    except Exception:\n        raise HTTPException(status_code=404, detail=\"Board not found\")\n    if current_user.is_admin:\n        return\n    if board.user_id == current_user.user_id:\n        return\n    if board.board_visibility == BoardVisibility.Public:\n        return\n    raise HTTPException(status_code=403, detail=\"Not authorized to modify this board\")\n\n\ndef _assert_video_read_access(video_name: str, current_user: CurrentUserOrDefault) -> None:\n    \"\"\"Raise 403 if the current user may not view the video.\"\"\"\n    from invokeai.app.services.board_records.board_records_common import (\n        BoardRecordNotFoundException,\n        BoardVisibility,\n    )\n\n    if current_user.is_admin:\n        return\n    owner = ApiDependencies.invoker.services.video_records.get_user_id(video_name)\n    if owner is not None and owner == current_user.user_id:\n        return\n\n    board_id = ApiDependencies.invoker.services.board_video_records.get_board_for_video(video_name)\n    if board_id is not None:\n        # See `assert_image_read_access`: only a board positively known to be gone may fall","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/videos.py#L127-L163","documentation":"After confirming the board exists, _assert_board_write_access raises HTTP 403 unless the caller is an admin, the board owner, or the board has BoardVisibility.Public. It gates add_video_to_board / remove_video_from_board, so users cannot mutate boards they do not own unless the boards accept public contributions.","triggerScenarios":"Adding/removing a video to/from a board owned by another user in multiuser mode where that board's visibility is Private (or Shared — only Public grants write).","commonSituations":"Multiuser installs where users try to organize into shared boards; expecting 'Shared' visibility to allow writes (it does not, only reads per _assert_video_read_access semantics); non-admin service tokens operating across accounts.","solutions":["Set the board's visibility to Public if contributions from all users are intended, or have the board owner perform the change","Use an admin account/token for cross-user board mutations","Ask the board owner to change visibility or add the video themselves","Verify the board's user_id and board_visibility via GET /api/v1/boards/{board_id} before calling"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"b = requests.get(f\"{base}/api/v1/boards/{board_id}\").json()\nassert is_admin or b[\"user_id\"] == my_user_id or b[\"board_visibility\"] == \"Public\", \"no write access\"","typeGuard":null,"tryCatchPattern":"try:\n    requests.post(f\"{base}/api/v1/videos/{name}/board\", json={\"board_id\": board_id}).raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 403:\n        request_access_or_use_own_board(board_id)","preventionTips":["Check board_visibility before writing — only Public accepts non-owner writes","Use admin tokens for cross-user board management","Document that Shared boards are read-only for others"],"tags":["http-403","authorization","boards","multiuser"],"backgroundTag":"insufficient-permissions","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}