{"record":{"id":"97fed9540b930a4b","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-update-this-board","errorCode":null,"errorMessage":"Not authorized to update this board","messagePattern":"Not authorized to update this board","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/boards.py","lineNumber":112,"sourceCode":"            \"description\": \"The board was updated successfully\",\n        },\n    },\n    status_code=201,\n    response_model=BoardDTO,\n)\ndef update_board(\n    current_user: CurrentUserOrDefault,\n    board_id: str = Path(description=\"The id of board to update\"),\n    changes: BoardChanges = Body(description=\"The changes to apply to the board\"),\n) -> BoardDTO:\n    \"\"\"Updates a board (user must have access to it)\"\"\"\n    try:\n        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)\n    except Exception:\n        raise HTTPException(status_code=404, detail=\"Board not found\")\n\n    if not current_user.is_admin and board.user_id != current_user.user_id:\n        raise HTTPException(status_code=403, detail=\"Not authorized to update this board\")\n\n    try:\n        result = ApiDependencies.invoker.services.boards.update(board_id=board_id, changes=changes)\n        return result\n    except Exception:\n        raise HTTPException(status_code=500, detail=\"Failed to update board\")\n\n\n@boards_router.delete(\"/{board_id}\", operation_id=\"delete_board\", response_model=DeleteBoardResult)\ndef delete_board(\n    current_user: CurrentUserOrDefault,\n    board_id: str = Path(description=\"The id of board to delete\"),\n    include_images: Optional[bool] = Query(\n        description=\"Permanently delete all images and videos on the board\", default=False\n    ),\n) -> DeleteBoardResult:\n    \"\"\"Deletes a board (user must have access to it)\"\"\"\n    try:","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/boards.py#L94-L130","documentation":"HTTP 403 from PATCH /boards/{board_id} raised after the board is fetched but the caller is neither an admin nor the board's owner (board.user_id != current_user.user_id). Update rights are restricted to owner or admin regardless of board visibility.","triggerScenarios":"PATCH /boards/{board_id} (rename, visibility change, cover image) authenticated as a non-owner non-admin user, e.g. a shared-board contributor trying to rename someone else's board.","commonSituations":"Multi-user deployments where collaborators attempt to edit a shared board's metadata, or automation configured with a service account that isn't the owner.","solutions":["Perform the update with the owner account or an admin","Have an admin grant the change, or transfer/recreate the board under the right user","Verify the auth token belongs to the intended user","Adjust automation to only mutate boards owned by its credentials"],"exampleFix":"// before\nawait api.patch(`/boards/${boardId}`, changes); // 403 if not owner\n// after\nconst board = await api.get(`/boards/${boardId}`);\nif (board.user_id !== myUserId) throw new Error('Only the board owner can update this board');\nawait api.patch(`/boards/${boardId}`, changes);","handlingStrategy":"validation","validationCode":"const board = await api.get(`/boards/${boardId}`);\nconst me = await api.get('/users/current'); // or your auth introspection\nif (!me.is_admin && board.user_id !== me.user_id) throw new Error('not authorized to update this board');","typeGuard":"const isForbidden = (e) => e?.response?.status === 403;","tryCatchPattern":"try {\n  return await api.patch(`/boards/${boardId}`, changes);\n} catch (e) {\n  if (isForbidden(e)) throw new Error(`user is not owner/admin of board ${boardId}`);\n  throw e;\n}","preventionTips":["Check board.user_id against the authenticated user before PATCH","Use admin credentials for cross-user board maintenance","Configure automation service accounts as owners of the boards they manage","Restrict shared-board collaborators from metadata changes in your UI"],"tags":["http-403","authorization","multi-user","boards"],"backgroundTag":"permission-denied","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}