{"record":{"id":"69fc81841a4244bd","repo":"invoke-ai/InvokeAI","slug":"user-account-is-disabled","errorCode":null,"errorMessage":"User account is disabled","messagePattern":"User account is disabled","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/auth.py","lineNumber":231,"sourceCode":"    # Check if multiuser is enabled\n    if not config.multiuser:\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Multiuser mode is disabled. Authentication is not required in single-user mode.\",\n        )\n\n    user_service = ApiDependencies.invoker.services.users\n    user = user_service.authenticate(login_request.email, login_request.password)\n\n    if user is None:\n        raise HTTPException(\n            status_code=status.HTTP_401_UNAUTHORIZED,\n            detail=\"Incorrect email or password\",\n            headers={\"WWW-Authenticate\": \"Bearer\"},\n        )\n\n    if not user.is_active:\n        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=\"User account is disabled\")\n\n    # Create token with appropriate expiration\n    expires_delta = timedelta(\n        days=TOKEN_EXPIRATION_REMEMBER_ME if login_request.remember_me else TOKEN_EXPIRATION_NORMAL\n    )\n    token_data = TokenData(\n        user_id=user.user_id,\n        email=user.email,\n        is_admin=user.is_admin,\n        remember_me=login_request.remember_me,\n        token_epoch=user.token_epoch,\n    )\n    token = create_access_token(token_data, expires_delta)\n    _set_media_cookie(request, response, token, int(expires_delta.total_seconds()))\n\n    return LoginResponse(\n        token=token,\n        user=user,","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/auth.py#L213-L249","documentation":"After credentials authenticate successfully, login checks user.is_active; a deactivated user gets 403 'User account is disabled'. This lets admins block accounts without deleting them.","triggerScenarios":"POST /auth/login with correct credentials belonging to a user whose is_active flag is False in the users store.","commonSituations":"Admin disabled the account via the user-management API; account deactivated pending approval; stale import/seed data marking users inactive; automation accounts disabled by policy.","solutions":["Have an admin re-enable the account (set is_active=True via the user management endpoint)","Log in with a different, active account","Recreate/reactivate the user if the account was disabled by mistake","If you're the admin, use the admin account to change the flag"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"# if you can query an admin endpoint, confirm the account is active first\nuser = admin_get_user(email)\nif user and not user['is_active']:\n    raise PermissionError(f'Account {email} is disabled; ask an admin to re-enable')","typeGuard":"def is_active_user(user: dict | None) -> bool:\n    return bool(user and user.get('is_active'))","tryCatchPattern":"try:\n    resp = requests.post(f'{base}/auth/login', json=creds)\n    resp.raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 403 and 'disabled' in e.response.json().get('detail', ''):\n        contact_admin()  # do not retry — account-level block","preventionTips":["Distinguish 403-disabled from 401-bad-password in client UX","Re-enable accounts through the admin user-management endpoint","Audit automation accounts so they aren't disabled by policy","Don't retry login on 403 — it will keep failing until reactivated"],"tags":["http-403","authentication","account-disabled"],"backgroundTag":"user-account-disabled","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}