{"record":{"id":"60bff4051cbb9332","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-access-this-download","errorCode":null,"errorMessage":"Not authorized to access this download","messagePattern":"Not authorized to access this download","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"invokeai/app/api/routers/images.py","lineNumber":830,"sourceCode":"        },\n        404: {\"description\": \"Image not found\"},\n    },\n)\ndef get_bulk_download_item(\n    current_user: CurrentUserOrDefault,\n    background_tasks: BackgroundTasks,\n    bulk_download_item_name: str = Path(description=\"The bulk_download_item_name of the bulk download item to get\"),\n) -> FileResponse:\n    \"\"\"Gets a bulk download zip file.\n\n    Requires authentication.  The caller must be the user who initiated the\n    download (tracked by the bulk download service) or an admin.\n    \"\"\"\n    try:\n        # Verify the caller owns this download (or is an admin)\n        owner = ApiDependencies.invoker.services.bulk_download.get_owner(bulk_download_item_name)\n        if owner is not None and owner != current_user.user_id and not current_user.is_admin:\n            raise HTTPException(status_code=403, detail=\"Not authorized to access this download\")\n\n        path = ApiDependencies.invoker.services.bulk_download.get_path(bulk_download_item_name)\n\n        response = FileResponse(\n            path,\n            media_type=\"application/zip\",\n            filename=bulk_download_item_name,\n            content_disposition_type=\"inline\",\n        )\n        response.headers[\"Cache-Control\"] = f\"max-age={IMAGE_MAX_AGE}\"\n        background_tasks.add_task(ApiDependencies.invoker.services.bulk_download.delete, bulk_download_item_name)\n        return response\n    except HTTPException:\n        raise\n    except Exception:\n        raise HTTPException(status_code=404)\n\n","sourceCodeStart":812,"sourceCodeEnd":848,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/images.py#L812-L848","documentation":"HTTP 403 raised by GET /images/download/{bulk_download_item_name} when the bulk download exists but is owned by a different non-admin user. The endpoint resolves the download's owner via services.bulk_download.get_owner() and denies access unless caller is the owner or an admin.","triggerScenarios":"GET /api/v1/images/download/{item_name} where owner is not None, owner != current_user.user_id, and current_user is not admin — e.g. sharing a download URL between users in a multi-user installation.","commonSituations":"Forwarding a download link to a colleague in a shared InvokeAI instance; session switched users but old download link still open; owner lookup returns another user's ID because the download was initiated by an admin on the user's behalf.","solutions":["Re-initiate the download while logged in as the requesting user","Have the owner user download it and share the file out-of-band","Ask an admin to retrieve the download","Verify you are logged in with the account that started the bulk download"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// only request downloads you initiated; track returned item names per session\nconst started = await api.downloadImagesFromList(names, boardId);\n// keep started.response item name; don't reuse names from other users","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch(`/api/v1/images/download/${itemName}`);\n  if (res.status === 403) {\n    // prompt user to re-start the download with their own account\n  }\n} catch (e) { /* network handling */ }","preventionTips":["Never share bulk-download URLs between users","Re-initiate the download from the requesting account","Track download item names in per-user client state","Ask an admin only as a fallback path"],"tags":["http-403","authorization","multi-user"],"backgroundTag":"resource-ownership-forbidden","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}