invoke-ai/InvokeAI · warning · HTTPException

Not authorized to access this system prompt

Error message

Not authorized to access this system prompt

What it means

HTTP 403 raised by GET system prompt when multiuser mode is enabled and the requesting user is neither the owner of the prompt, nor the prompt is public, nor the user is an admin. The prompt exists (otherwise 404 would fire first); this is purely an authorization check enforced at invokeai/app/api/routers/system_prompts.py:51.

Source

Thrown at invokeai/app/api/routers/system_prompts.py:51

    "/i/{system_prompt_id}",
    operation_id="get_system_prompt",
    responses={200: {"model": SystemPromptRecordDTO}},
)
def get_system_prompt(
    current_user: CurrentUserOrDefault,
    system_prompt_id: str = Path(description="The id of the system prompt to get"),
) -> SystemPromptRecordDTO:
    """Gets a system prompt by id."""
    try:
        prompt = ApiDependencies.invoker.services.system_prompt_records.get(system_prompt_id)
    except SystemPromptNotFoundError:
        raise HTTPException(status_code=404, detail="System prompt not found")

    config = ApiDependencies.invoker.services.configuration
    if config.multiuser:
        is_owner = prompt.user_id == current_user.user_id
        if not (is_owner or prompt.is_public or current_user.is_admin):
            raise HTTPException(status_code=403, detail="Not authorized to access this system prompt")
    return prompt


@system_prompts_router.post(
    "/",
    operation_id="create_system_prompt",
    responses={200: {"model": SystemPromptRecordDTO}},
)
def create_system_prompt(
    current_user: CurrentUserOrDefault,
    system_prompt: SystemPromptWithoutId = Body(description="The system prompt to create"),
) -> SystemPromptRecordDTO:
    """Creates a new system prompt owned by the current user."""
    # Single-user: shared so legacy/single-user behaviour is unchanged. Multiuser: private by default.
    config = ApiDependencies.invoker.services.configuration
    is_public = not config.multiuser
    return ApiDependencies.invoker.services.system_prompt_records.create(
        system_prompt, user_id=current_user.user_id, is_public=is_public

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Have the prompt owner set is_public=true on the prompt so any user can read it
2. Retry the request with an admin account token
3. Verify you are authenticated as the user who created the prompt (check the JWT/sub claim)
4. If single-user usage is intended, disable multiuser in the InvokeAI configuration

Example fix

null

const prompt = await api.getSystemPromptOwner(id); // or check listing metadata
if (config.multiuser && prompt.user_id !== currentUser.user_id && !prompt.is_public && !currentUser.is_admin) {
  throw new Error('Skipping fetch: prompt is private and not owned by current user');
}

function canAccessPrompt(prompt, user) {
  return !config.multiuser || prompt.user_id === user.user_id || prompt.is_public === true || user.is_admin === true;
}

try {
  const prompt = await api.getSystemPrompt(id);
} catch (e) {
  if (e.status === 403) console.warn('No access to this private prompt');
  else if (e.status === 404) console.warn('Prompt does not exist');
  else throw e;
}

When it happens

Trigger: GET /system_prompts/i/{system_prompt_id} with config.multiuser=true, where prompt.user_id != current_user.user_id, prompt.is_public is false, and current_user.is_admin is false.

Common situations: Multi-tenant InvokeAI deployments where users fetch prompts shared by id (e.g. copied from another user) that were never made public; tokens for a different account than the prompt owner; forgotten is_public flag.

Related errors

• Not authorized to update this system prompt
• Not authorized to delete this system prompt
• You do not have permission to delete this queue item
• Only admins can create default presets
• Not authorized to modify this video

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/82a081bcd4039854. Report an issue: GitHub.