{"record":{"id":"cc883f5a5d2634c8","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-access-this-board","errorCode":null,"errorMessage":"Not authorized to access this board","messagePattern":"Not authorized to access this board","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/_access.py","lineNumber":137,"sourceCode":"    - The user is an admin.\n    - The user owns the board.\n    - The board visibility is Shared or Public.\n    \"\"\"\n    if current_user.is_admin:\n        return\n\n    try:\n        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)\n    except Exception:\n        raise HTTPException(status_code=404, detail=\"Board not found\")\n\n    if board.user_id == current_user.user_id:\n        return\n\n    if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):\n        return\n\n    raise HTTPException(status_code=403, detail=\"Not authorized to access this board\")\n","sourceCodeStart":119,"sourceCodeEnd":138,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/_access.py#L119-L138","documentation":"`assert_board_read_access` raises this 403 when the board exists but the current non-admin user may not read its images: they do not own the board and the board visibility is Private (neither Shared nor Public).","triggerScenarios":"GET /v1/boards/{board_id} or /v1/board_images/{board_id} in multiuser mode where the board belongs to another user and board.board_visibility is 'private' (default for new boards).","commonSituations":"Multiuser installations where each user's boards are private by default; a teammate browsing another user's boards; automated scripts using one user's token against another user's board IDs.","solutions":["Ask the board owner to set the board visibility to 'shared' or 'public' (PATCH /v1/boards/{board_id})","Have an admin perform the read or grant your account admin/ownership","Use your own board: create a board with POST /v1/boards/ and operate on that board_id","Check that you are authenticated as the intended user; switch tokens if a service account is being used unintentionally"],"exampleFix":"// before\nawait fetch(`/v1/board_images/${someoneElsesBoardId}`); // 403\n// after\nawait fetch(`/v1/boards/${someoneElsesBoardId}`, { method: 'PATCH', body: JSON.stringify({ board_visibility: 'shared' }) }); // by board owner\nawait fetch(`/v1/board_images/${someoneElsesBoardId}`);","handlingStrategy":"try-catch","validationCode":"const board = await fetch(`/v1/boards/${boardId}`, {headers: authHeaders}).then(r => {\n  if (!r.ok) throw new Error('board unavailable'); return r.json();\n});\nif (board.user_id !== currentUser.user_id && !['shared','public'].includes(board.board_visibility))\n  throw new Error(`Board ${boardId} is private to another user`);","typeGuard":"function canReadBoard(board, user) {\n  return user.is_admin || board.user_id === user.user_id ||\n    ['shared','public'].includes(board.board_visibility);\n}","tryCatchPattern":"try {\n  const res = await fetch(`/v1/board_images/${boardId}`, {headers: authHeaders});\n  if (res.status === 403) throw new ForbiddenError(boardId);\n  return await res.json();\n} catch (e) {\n  if (e instanceof ForbiddenError) requestBoardAccessFromOwner(e.boardId); // ask owner to set 'shared'\n  else throw e;\n}","preventionTips":["In multiuser installs, expect new boards to be private; set visibility explicitly for collaboration","Share board IDs together with the visibility change from the owner","Validate board ownership/visibility client-side before listing board images","Use your own token/account rather than another user's board IDs in automation"],"tags":["auth","forbidden","board","multiuser","board-visibility"],"backgroundTag":"insufficient-permissions-403","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}