invoke-ai/InvokeAI · warning · HTTPException

Not authorized to access this download

Error message

Not authorized to access this download

What it means

HTTP 403 raised by GET /images/download/{bulk_download_item_name} when the bulk download exists but is owned by a different non-admin user. The endpoint resolves the download's owner via services.bulk_download.get_owner() and denies access unless caller is the owner or an admin.

Source

Thrown at invokeai/app/api/routers/images.py:830

        },
        404: {"description": "Image not found"},
    },
)
def get_bulk_download_item(
    current_user: CurrentUserOrDefault,
    background_tasks: BackgroundTasks,
    bulk_download_item_name: str = Path(description="The bulk_download_item_name of the bulk download item to get"),
) -> FileResponse:
    """Gets a bulk download zip file.

    Requires authentication.  The caller must be the user who initiated the
    download (tracked by the bulk download service) or an admin.
    """
    try:
        # Verify the caller owns this download (or is an admin)
        owner = ApiDependencies.invoker.services.bulk_download.get_owner(bulk_download_item_name)
        if owner is not None and owner != current_user.user_id and not current_user.is_admin:
            raise HTTPException(status_code=403, detail="Not authorized to access this download")

        path = ApiDependencies.invoker.services.bulk_download.get_path(bulk_download_item_name)

        response = FileResponse(
            path,
            media_type="application/zip",
            filename=bulk_download_item_name,
            content_disposition_type="inline",
        )
        response.headers["Cache-Control"] = f"max-age={IMAGE_MAX_AGE}"
        background_tasks.add_task(ApiDependencies.invoker.services.bulk_download.delete, bulk_download_item_name)
        return response
    except HTTPException:
        raise
    except Exception:
        raise HTTPException(status_code=404)

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Re-initiate the download while logged in as the requesting user
2. Have the owner user download it and share the file out-of-band
3. Ask an admin to retrieve the download
4. Verify you are logged in with the account that started the bulk download

// only request downloads you initiated; track returned item names per session
const started = await api.downloadImagesFromList(names, boardId);
// keep started.response item name; don't reuse names from other users

try {
  const res = await fetch(`/api/v1/images/download/${itemName}`);
  if (res.status === 403) {
    // prompt user to re-start the download with their own account
  }
} catch (e) { /* network handling */ }

When it happens

Trigger: GET /api/v1/images/download/{item_name} where owner is not None, owner != current_user.user_id, and current_user is not admin — e.g. sharing a download URL between users in a multi-user installation.

Common situations: Forwarding a download link to a colleague in a shared InvokeAI instance; session switched users but old download link still open; owner lookup returns another user's ID because the download was initiated by an admin on the user's behalf.

Related errors

• Not authorized to access this board
• Not authorized to update this board
• You do not have permission to delete this queue item
• You do not have permission to cancel this queue item
• Not authorized to access this style preset

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/60bff4051cbb9332. Report an issue: GitHub.