{"record":{"id":"fd9cdfe83d63f9e8","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-delete-this-system-prompt","errorCode":null,"errorMessage":"Not authorized to delete this system prompt","messagePattern":"Not authorized to delete this system prompt","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"warning","filePath":"invokeai/app/api/routers/system_prompts.py","lineNumber":115,"sourceCode":"\n\n@system_prompts_router.delete(\n    \"/i/{system_prompt_id}\",\n    operation_id=\"delete_system_prompt\",\n)\ndef delete_system_prompt(\n    current_user: CurrentUserOrDefault,\n    system_prompt_id: str = Path(description=\"The id of the system prompt to delete\"),\n) -> None:\n    \"\"\"Deletes a system prompt. Only the owner or an admin may delete.\"\"\"\n    config = ApiDependencies.invoker.services.configuration\n    if config.multiuser:\n        try:\n            existing = ApiDependencies.invoker.services.system_prompt_records.get(system_prompt_id)\n        except SystemPromptNotFoundError:\n            raise HTTPException(status_code=404, detail=\"System prompt not found\")\n        if not current_user.is_admin and existing.user_id != current_user.user_id:\n            raise HTTPException(status_code=403, detail=\"Not authorized to delete this system prompt\")\n    user_id = None if current_user.is_admin else current_user.user_id\n    try:\n        ApiDependencies.invoker.services.system_prompt_records.delete(system_prompt_id, user_id=user_id)\n    except SystemPromptNotFoundError:\n        raise HTTPException(status_code=404, detail=\"System prompt not found\")\n","sourceCodeStart":97,"sourceCodeEnd":121,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/system_prompts.py#L97-L121","documentation":"HTTP 403 raised in delete_system_prompt when multiuser is enabled and the caller is neither admin nor owner (existing.user_id != current_user.user_id), enforced at invokeai/app/api/routers/system_prompts.py:115 before deletion.","triggerScenarios":"DELETE /system_prompts/i/{system_prompt_id} with config.multiuser=true, prompt exists, caller's user_id differs from existing.user_id and is_admin is false.","commonSituations":"Cleanup scripts running under a non-admin service account trying to delete other users' prompts; users deleting teammates' prompts in a shared instance.","solutions":["Use an admin token for cross-user cleanup scripts","Run the deletion as the prompt owner","Have an admin grant the account admin privileges if appropriate","Disable multiuser if per-user ownership boundaries are not needed"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"const target = await api.getSystemPrompt(id);\nif (target.user_id !== currentUser.user_id && !currentUser.is_admin) {\n  throw new Error(`User ${currentUser.user_id} cannot delete prompt owned by ${target.user_id}`);\n}","typeGuard":"function canDeletePrompt(prompt, user) {\n  return user.is_admin === true || prompt.user_id === user.user_id;\n}","tryCatchPattern":"null","preventionTips":["Run cleanup scripts with an admin token in multiuser deployments","Hide delete controls on prompts the user does not own","Document ownership boundaries for shared instances"],"tags":["http-403","authorization","multiuser","fastapi"],"backgroundTag":"http-403-forbidden","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}