{"record":{"id":"d2b55eff2cdbadfb","repo":"invoke-ai/InvokeAI","slug":"you-do-not-have-permission-to-delete-this-queue-it","errorCode":null,"errorMessage":"You do not have permission to delete this queue item","messagePattern":"You do not have permission to delete this queue item","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"invokeai/app/api/routers/session_queue.py","lineNumber":604,"sourceCode":"def delete_queue_item(\n    current_user: CurrentUserOrDefault,\n    queue_id: str = Path(description=\"The queue id to perform this operation on\"),\n    item_id: int = Path(description=\"The queue item to delete\"),\n) -> None:\n    \"\"\"Deletes a queue item. Users can only delete their own items unless they are an admin.\"\"\"\n    try:\n        # Get the queue item to check ownership\n        queue_item = ApiDependencies.invoker.services.session_queue.get_queue_item(item_id)\n        if queue_item.queue_id != queue_id:\n            raise HTTPException(status_code=404, detail=f\"Queue item with id {item_id} not found in queue {queue_id}\")\n\n        root_queue_item = _get_workflow_call_root_queue_item(queue_item)\n        if root_queue_item.queue_id != queue_id:\n            raise HTTPException(status_code=404, detail=f\"Queue item with id {item_id} not found in queue {queue_id}\")\n\n        # The queue service deletes the entire chain, so authorization must use the root owner.\n        if root_queue_item.user_id != current_user.user_id and not current_user.is_admin:\n            raise HTTPException(status_code=403, detail=\"You do not have permission to delete this queue item\")\n\n        ApiDependencies.invoker.services.session_queue.delete_queue_item(item_id)\n    except SessionQueueItemNotFoundError:\n        raise HTTPException(status_code=404, detail=f\"Queue item with id {item_id} not found in queue {queue_id}\")\n    except HTTPException:\n        raise\n    except Exception as e:\n        raise HTTPException(status_code=500, detail=f\"Unexpected error while deleting queue item: {e}\")\n\n\n@session_queue_router.put(\n    \"/{queue_id}/i/{item_id}/cancel\",\n    operation_id=\"cancel_queue_item\",\n    responses={\n        200: {\"model\": SessionQueueItem},\n    },\n)\ndef cancel_queue_item(","sourceCodeStart":586,"sourceCodeEnd":622,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/session_queue.py#L586-L622","documentation":"HTTPException(403) raised in DELETE /session_queue/{queue_id}/i/{item_id} when the authenticated user is neither the owner of the queue item chain's root item nor an admin. Authorization is deliberately based on the root owner because the delete removes the entire workflow-call chain.","triggerScenarios":"A non-admin user calling DELETE on a queue item whose root_queue_item.user_id differs from their own user_id — e.g. deleting another user's queued generation in a shared/multi-user InvokeAI deployment.","commonSituations":"Multi-user setups where users share queue visibility but not delete rights; service accounts or API tokens running as a different user than the one who enqueued the item; sessions switching users while a UI keeps old items loaded.","solutions":["Have an admin perform the delete, or log in as the user who owns the root queue item","If the token should own the items, re-enqueue using the intended user's credentials","Ask the server admin to grant admin rights if this account legitimately needs to manage all queue items"],"exampleFix":"// before: delete as wrong user -> 403\nawait api.delete(`/api/v1/session_queue/${queueId}/i/${itemId}`)\n// after: check ownership client-side first\nif (rootItem.user_id !== currentUser.id && !currentUser.is_admin) {\n  throw new Error('Not permitted; ask an admin or the owner')\n}","handlingStrategy":"validation","validationCode":"// check ownership before attempting delete\nconst item = await api.get(`/api/v1/session_queue/${queueId}/i/${itemId}`)\nif (item.data.user_id !== currentUser.id && !currentUser.is_admin) {\n  throw new Error('Only the owner or an admin can delete this queue item')\n}","typeGuard":"function canDelete(item, currentUser) {\n  return currentUser?.is_admin === true || item?.user_id === currentUser?.id\n}","tryCatchPattern":"try {\n  await api.delete(`/api/v1/session_queue/${queueId}/i/${itemId}`)\n} catch (e) {\n  if (e.response?.status === 403) {\n    notify('You lack permission to delete this item; ask an admin or the owner')\n  } else throw e\n}","preventionTips":["Authenticate with the same user that enqueued the items you manage","In multi-user deployments, route admin actions through an admin account","Surface ownership info (user_id) in your UI before offering delete"],"tags":["fastapi","http-403","authorization","multi-user"],"backgroundTag":"insufficient-permissions","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}