{"record":{"id":"952e4681d7feeb22","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-delete-this-workflow","errorCode":null,"errorMessage":"Not authorized to delete this workflow","messagePattern":"Not authorized to delete this workflow","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/workflows.py","lineNumber":120,"sourceCode":"\n@workflows_router.delete(\n    \"/i/{workflow_id}\",\n    operation_id=\"delete_workflow\",\n)\ndef delete_workflow(\n    current_user: CurrentUserOrDefault,\n    workflow_id: str = Path(description=\"The workflow to delete\"),\n) -> None:\n    \"\"\"Deletes a workflow\"\"\"\n    try:\n        existing = ApiDependencies.invoker.services.workflow_records.get(workflow_id)\n    except WorkflowNotFoundError:\n        raise HTTPException(status_code=404, detail=\"Workflow not found\")\n\n    config = ApiDependencies.invoker.services.configuration\n    if config.multiuser:\n        if not current_user.is_admin and existing.user_id != current_user.user_id:\n            raise HTTPException(status_code=403, detail=\"Not authorized to delete this workflow\")\n    try:\n        ApiDependencies.invoker.services.workflow_thumbnails.delete(workflow_id)\n    except WorkflowThumbnailFileNotFoundException:\n        # It's OK if the workflow has no thumbnail file. We can still delete the workflow.\n        pass\n    user_id = None if current_user.is_admin else current_user.user_id\n    ApiDependencies.invoker.services.workflow_records.delete(workflow_id, user_id=user_id)\n    ApiDependencies.invoker.services.events.emit_workflow_deleted(\n        workflow_id=existing.workflow_id,\n        user_id=existing.user_id,\n        is_public=existing.is_public,\n    )\n\n\n@workflows_router.post(\n    \"/\",\n    operation_id=\"create_workflow\",\n    responses={","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/workflows.py#L102-L138","documentation":"HTTP 403 raised by delete_workflow when multiuser mode is on and a non-admin user tries to delete a workflow owned by a different user. Existence was already confirmed (a 404 would have fired first); this is purely an authorization failure.","triggerScenarios":"DELETE /workflows/i/{workflow_id} with config.multiuser=true, current_user.is_admin=false, and existing.user_id != current_user.user_id.","commonSituations":"Shared InvokeAI server where users attempt to clean up colleagues' workflows; scripts running with a non-admin token after workflows were reassigned; UI listing public workflows from other users that look deletable.","solutions":["Delete as an admin account","Only delete workflows your own user created (filter list by owner in the UI)","Disable multiuser if the deployment is effectively single-user","Have an admin delete it or transfer ownership in the DB"],"exampleFix":"// before\nawait api.delete(`/workflows/i/${anyVisibleWorkflowId}`); // 403\n// after\nconst all = await api.get('/workflows/').then(r=>r.json());\nconst mine = all.filter(w => w.user_id === myUserId); // delete only owned workflows","handlingStrategy":"validation","validationCode":"const wf = await fetch(`/api/v1/workflows/i/${id}`).then(r=>r.json());\nif (wf.user_id !== myUserId && !isAdmin) throw new Error('Not authorized to delete this workflow');","typeGuard":"function canModify(wf, user) { return user.is_admin || wf.user_id === user.user_id; }","tryCatchPattern":"try { await deleteWorkflow(id); } catch (e) { if (e?.status === 403) notify('Owned by another user'); else throw e; }","preventionTips":["Only offer delete actions for workflows the user owns","Filter workflow listings by owner before showing destructive actions","Document multiuser ownership rules to server operators"],"tags":["http-403","authorization","multiuser","rest-api"],"backgroundTag":"insufficient-permissions","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}