{"record":{"id":"8f812260a717f10c","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-access-this-video","errorCode":null,"errorMessage":"Not authorized to access this video","messagePattern":"Not authorized to access this video","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/videos.py","lineNumber":178,"sourceCode":"\n    board_id = ApiDependencies.invoker.services.board_video_records.get_board_for_video(video_name)\n    if board_id is not None:\n        # See `assert_image_read_access`: only a board positively known to be gone may fall\n        # through to a refusal; a lookup that cannot be decided propagates instead of\n        # impersonating a permission decision.\n        try:\n            board = ApiDependencies.invoker.services.board_records.get(board_id)\n        except BoardRecordNotFoundException:\n            pass\n        else:\n            if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):\n                return\n\n    # Gone and denied mean opposite things to a client holding a reference to this video, and\n    # nothing above can tell them apart. See `_assert_image_record_exists`.\n    if not ApiDependencies.invoker.services.video_records.exists(video_name):\n        raise HTTPException(status_code=404, detail=\"Video not found\")\n    raise HTTPException(status_code=403, detail=\"Not authorized to access this video\")\n\n\ndef _is_accepted_video_upload(file: UploadFile) -> bool:\n    if file.content_type and file.content_type.startswith(ACCEPTED_VIDEO_MIME_PREFIXES):\n        return True\n    if file.filename:\n        return file.filename.lower().endswith(ACCEPTED_VIDEO_EXTENSIONS)\n    return False\n\n\ndef _is_mp4_file(path: Path) -> bool:\n    try:\n        with open(path, \"rb\") as video_file:\n            search_limit = min(path.stat().st_size, 64 * 1024)\n            position = 0\n            while position + 8 <= search_limit:\n                video_file.seek(position)\n                header = video_file.read(8)","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/videos.py#L160-L196","documentation":"If the video record exists but no ownership/board-visibility rule grants the current user access, _assert_video_read_access raises HTTP 403 \"Not authorized to access this video\". This is returned instead of 404 precisely when the video exists but the caller (non-admin, not owner, video on a board that is not Shared/Public) may not view it.","triggerScenarios":"GET /api/v1/videos/{video_name}/... in multiuser mode for another tenant's video that sits on a private (or shared-but-not-public per policy) board, using a non-admin token.","commonSituations":"Multiuser InvokeAI where users exchange video names out-of-band; service tokens for one account fetching another's assets; videos on deleted boards (board lookup fails, falls through to denial).","solutions":["Use an admin token if cross-tenant access is legitimately needed","Have the video owner move the video to a Public/Shared board","Log in as the owning user","Verify which user the current token resolves to — stale or misconfigured auth often causes unexpected denials"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"try:\n    requests.get(f\"{base}/api/v1/videos/{name}\").raise_for_status()\nexcept requests.HTTPError as e:\n    assert e.response.status_code != 403, \"no read access to this video\"","typeGuard":null,"tryCatchPattern":"try:\n    resp = requests.get(f\"{base}/api/v1/videos/{video_name}/full\")\n    resp.raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 403:\n        request_access_from_owner(video_name)","preventionTips":["Never assume possession of a video name implies read access in multiuser mode","Share videos via Public/Shared boards instead of copying names","Audit which user your token resolves to before batch fetches"],"tags":["http-403","authorization","multiuser","videos"],"backgroundTag":"insufficient-permissions","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}