invoke-ai/InvokeAI · warning · HTTPException

Not authorized to access image {image_name}

Error message

Not authorized to access image {image_name}

What it means

HTTP 403 raised by the recall-parameters endpoints when the authenticated user is not permitted to access the requested image. The check ensures users cannot probe image existence/leak dimensions or mint derived images (e.g. via ControlNet preprocessors) for images they don't own or that aren't on a shared/public board.

Source

Thrown at invokeai/app/api/routers/recall_parameters.py:394

    if current_user.is_admin:
        return

    for image_name in image_names:
        owner = ApiDependencies.invoker.services.image_records.get_user_id(image_name)
        if owner is not None and owner == current_user.user_id:
            continue

        # Check board visibility
        board_id = ApiDependencies.invoker.services.board_image_records.get_board_for_image(image_name)
        if board_id is not None:
            try:
                board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
                if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):
                    continue
            except Exception:
                pass

        raise HTTPException(status_code=403, detail=f"Not authorized to access image {image_name}")


@recall_parameters_router.post(
    "/{queue_id}",
    operation_id="update_recall_parameters",
    response_model=dict[str, Any],
)
def update_recall_parameters(
    current_user: CurrentUserOrDefault,
    queue_id: str = Path(..., description="The queue id to perform this operation on"),
    parameters: RecallParameter = Body(..., description="Recall parameters to update"),
    strict: bool = Query(
        default=False,
        description="When true, parameters not included in the request are reset to their defaults (cleared).",
    ),
    append: bool = Query(
        default=False,
        description=(

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Use an image the current user owns, or one on a Shared/Public board
2. Ask the image owner to share its board or move the image to a shared/public board
3. Remove the inaccessible image_name from the recall request's reference list
4. Check board visibility (board_visibility Shared/Public) before recalling

Example fix

// before
const images = await Promise.all(names.map(n => api.recallParameters(queueId, { image_names: [n] })));
// after
const accessible = [];
for (const n of names) {
  try { const img = await api.getImageDto(n); accessible.push(img); } catch { /* skip 403 */ }
}
await api.recallParameters(queueId, { image_names: accessible.map(i => i.image_name) });

const dto = await api.getImageDto(imageName); // throws 403 early if inaccessible
const board = dto.board_id ? await api.getBoard(dto.board_id) : null;
const accessible = !board || ['shared', 'public'].includes(board.board_visibility);
if (!accessible) throw new Error(`Skipping inaccessible image ${imageName}`);

function isBoardAccessible(board) {
  return board == null || board.board_visibility === 'shared' || board.board_visibility === 'public';
}

try {
  await api.recallParameters(queueId, { image_names: [name] });
} catch (e) {
  if (e.status === 403) {
    console.warn(`No access to image ${name}; skipping`);
  } else throw e;
}

When it happens

Trigger: POST /api/v1/recall_parameters/{queue_id} referencing an image_name the user doesn't own, where the image's board (if any) is not Shared or Public board visibility.

Common situations: Sharing a workflow/queue between users whose images are private; recalling parameters from another user's image; images moved to a private board after the reference was created.

Related errors

• Not authorized to modify this board
• Not authorized to move this image
• Not authorized to access this board
• Not authorized to update this board
• Not authorized to delete this board

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/047616daeac65373. Report an issue: GitHub.