{"record":{"id":"ff75c22778043456","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-modify-this-video","errorCode":null,"errorMessage":"Not authorized to modify this video","messagePattern":"Not authorized to modify this video","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/videos.py","lineNumber":108,"sourceCode":"\n    if current_user.is_admin:\n        return\n    owner = ApiDependencies.invoker.services.video_records.get_user_id(video_name)\n    if owner is not None and owner == current_user.user_id:\n        return\n\n    board_id = ApiDependencies.invoker.services.board_video_records.get_board_for_video(video_name)\n    if board_id is not None:\n        try:\n            board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)\n            if board.user_id == current_user.user_id:\n                return\n            if board.board_visibility == BoardVisibility.Public:\n                return\n        except Exception:\n            pass\n\n    raise HTTPException(status_code=403, detail=\"Not authorized to modify this video\")\n\n\ndef _assert_video_direct_owner(video_name: str, current_user: CurrentUserOrDefault) -> None:\n    \"\"\"Raise 403 if the current user is not the direct owner of the video.\n\n    Intentionally stricter than _assert_video_owner: board-ownership and public-board\n    fallbacks are NOT honored. Mirrors _assert_image_direct_owner in board_images.py —\n    board-move operations need to verify the *original* owner, otherwise a user could\n    move someone else's video onto their own board via the board-owner branch.\n    \"\"\"\n    if current_user.is_admin:\n        return\n    owner = ApiDependencies.invoker.services.video_records.get_user_id(video_name)\n    if owner is not None and owner == current_user.user_id:\n        return\n    raise HTTPException(status_code=403, detail=\"Not authorized to move this video\")\n\n","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/videos.py#L90-L126","documentation":"_assert_video_owner raises HTTP 403 when the current user is neither an admin, nor the direct owner of the video record, nor the owner of (or a viewer of a Public) board containing the video. Delete/update/star video endpoints call it before mutating, so non-owners cannot modify other tenants' videos.","triggerScenarios":"DELETE/PATCH or batch star/delete calls on /api/v1/videos/... for a video owned by another user, in multiuser mode, where the video's board is private, missing, or owned by a third user.","commonSituations":"Multiuser InvokeAI where a user references another tenant's video names; shared scripts running under a non-admin token; board deleted so the board-ownership fallback cannot grant access (the except: pass branch swallows the lookup error).","solutions":["Log in as an admin user or use an admin token for cross-tenant video operations","Operate only on videos your user created (verify owner via video DTO before calling)","If the video should be shared, move it to a Public board owned appropriately or have the owner perform the action","Confirm the correct user account/token is being sent — stale auth tokens can resolve to the wrong user"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"dto = requests.get(f\"{base}/api/v1/videos/{name}\")\nif dto.status_code != 200:\n    raise SkipVideo(name)\n# also confirm your token belongs to the owner or an admin","typeGuard":null,"tryCatchPattern":"try:\n    requests.delete(f\"{base}/api/v1/videos/{name}\").raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 403:\n        log.warning(f\"no permission to modify video {name}; skipping\")","preventionTips":["Operate only on videos created by the authenticated user","Use admin tokens for cross-tenant maintenance tasks","Check board ownership/visibility before batch operations"],"tags":["http-403","authorization","multiuser","videos"],"backgroundTag":"insufficient-permissions","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}