{"record":{"id":"82a081bcd4039854","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-access-this-system-prompt","errorCode":null,"errorMessage":"Not authorized to access this system prompt","messagePattern":"Not authorized to access this system prompt","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"invokeai/app/api/routers/system_prompts.py","lineNumber":51,"sourceCode":"    \"/i/{system_prompt_id}\",\n    operation_id=\"get_system_prompt\",\n    responses={200: {\"model\": SystemPromptRecordDTO}},\n)\ndef get_system_prompt(\n    current_user: CurrentUserOrDefault,\n    system_prompt_id: str = Path(description=\"The id of the system prompt to get\"),\n) -> SystemPromptRecordDTO:\n    \"\"\"Gets a system prompt by id.\"\"\"\n    try:\n        prompt = ApiDependencies.invoker.services.system_prompt_records.get(system_prompt_id)\n    except SystemPromptNotFoundError:\n        raise HTTPException(status_code=404, detail=\"System prompt not found\")\n\n    config = ApiDependencies.invoker.services.configuration\n    if config.multiuser:\n        is_owner = prompt.user_id == current_user.user_id\n        if not (is_owner or prompt.is_public or current_user.is_admin):\n            raise HTTPException(status_code=403, detail=\"Not authorized to access this system prompt\")\n    return prompt\n\n\n@system_prompts_router.post(\n    \"/\",\n    operation_id=\"create_system_prompt\",\n    responses={200: {\"model\": SystemPromptRecordDTO}},\n)\ndef create_system_prompt(\n    current_user: CurrentUserOrDefault,\n    system_prompt: SystemPromptWithoutId = Body(description=\"The system prompt to create\"),\n) -> SystemPromptRecordDTO:\n    \"\"\"Creates a new system prompt owned by the current user.\"\"\"\n    # Single-user: shared so legacy/single-user behaviour is unchanged. Multiuser: private by default.\n    config = ApiDependencies.invoker.services.configuration\n    is_public = not config.multiuser\n    return ApiDependencies.invoker.services.system_prompt_records.create(\n        system_prompt, user_id=current_user.user_id, is_public=is_public","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/system_prompts.py#L33-L69","documentation":"HTTP 403 raised by GET system prompt when multiuser mode is enabled and the requesting user is neither the owner of the prompt, nor the prompt is public, nor the user is an admin. The prompt exists (otherwise 404 would fire first); this is purely an authorization check enforced at invokeai/app/api/routers/system_prompts.py:51.","triggerScenarios":"GET /system_prompts/i/{system_prompt_id} with config.multiuser=true, where prompt.user_id != current_user.user_id, prompt.is_public is false, and current_user.is_admin is false.","commonSituations":"Multi-tenant InvokeAI deployments where users fetch prompts shared by id (e.g. copied from another user) that were never made public; tokens for a different account than the prompt owner; forgotten is_public flag.","solutions":["Have the prompt owner set is_public=true on the prompt so any user can read it","Retry the request with an admin account token","Verify you are authenticated as the user who created the prompt (check the JWT/sub claim)","If single-user usage is intended, disable multiuser in the InvokeAI configuration"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"const prompt = await api.getSystemPromptOwner(id); // or check listing metadata\nif (config.multiuser && prompt.user_id !== currentUser.user_id && !prompt.is_public && !currentUser.is_admin) {\n  throw new Error('Skipping fetch: prompt is private and not owned by current user');\n}","typeGuard":"function canAccessPrompt(prompt, user) {\n  return !config.multiuser || prompt.user_id === user.user_id || prompt.is_public === true || user.is_admin === true;\n}","tryCatchPattern":"try {\n  const prompt = await api.getSystemPrompt(id);\n} catch (e) {\n  if (e.status === 403) console.warn('No access to this private prompt');\n  else if (e.status === 404) console.warn('Prompt does not exist');\n  else throw e;\n}","preventionTips":["Check prompt.is_public before sharing ids across users","Use the owner's or an admin token when fetching private prompts","Don't guess prompt ownership in multiuser deployments"],"tags":["http-403","authorization","multiuser","fastapi"],"backgroundTag":"http-403-forbidden","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}