invoke-ai/InvokeAI · warning · HTTPException

Not authorized to access this workflow

Error message

Not authorized to access this workflow

What it means

HTTP 403 raised by get_workflow when multiuser mode is enabled and the requesting user is neither the workflow owner, nor an admin, and the workflow is neither Default-category nor public. This is an authorization check, not a lookup failure — the workflow exists but access is denied.

Source

Thrown at invokeai/app/api/routers/workflows.py:54

        200: {"model": WorkflowRecordWithThumbnailDTO},
    },
)
def get_workflow(
    current_user: CurrentUserOrDefault,
    workflow_id: str = Path(description="The workflow to get"),
) -> WorkflowRecordWithThumbnailDTO:
    """Gets a workflow"""
    try:
        workflow = ApiDependencies.invoker.services.workflow_records.get(workflow_id)
    except WorkflowNotFoundError:
        raise HTTPException(status_code=404, detail="Workflow not found")

    config = ApiDependencies.invoker.services.configuration
    if config.multiuser:
        is_default = workflow.workflow.meta.category is WorkflowCategory.Default
        is_owner = workflow.user_id == current_user.user_id
        if not (is_default or is_owner or workflow.is_public or current_user.is_admin):
            raise HTTPException(status_code=403, detail="Not authorized to access this workflow")

    thumbnail_url = ApiDependencies.invoker.services.workflow_thumbnails.get_url(workflow_id)
    compatibility = get_workflow_call_compatibility(
        workflow=workflow.workflow.model_dump(),
        workflow_id=workflow.workflow_id,
        services=ApiDependencies.invoker.services,
        user_id=current_user.user_id,
        maximum_children=ApiDependencies.invoker.services.configuration.max_queue_size,
    )
    return WorkflowRecordWithThumbnailDTO(
        thumbnail_url=thumbnail_url,
        call_saved_workflow_compatibility=compatibility,
        **workflow.model_dump(),
    )


@workflows_router.patch(
    "/i/{workflow_id}",

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Have the workflow owner set the workflow to public (or re-save it in the Default category)
2. Log in as the owner or an admin user to access it
3. Use an admin token for administrative tooling
4. If multiuser is not needed, disable configuration.multiuser so all workflows are accessible

Example fix

// before
wf = client.get_workflow(wf_id)  # 403 in multiuser
// after
# owner makes workflow public first
client.update_workflow({**wf_dict, 'is_public': True})  # as owner
wf = client.get_workflow(wf_id)

// detect multiuser mode and prefer workflows owned by / shared with the current user
const cfg = await fetch(`${base}/api/v1/system/config`).then(r => r.json());
const multiuser = cfg.multiuser;
const list = await fetch(`${base}/api/v1/workflows`).then(r => r.json());
const accessible = list.items.filter(w => !multiuser || w.is_public || w.category === 'Default');

function canAccessWorkflow(w, userId, isAdmin) {
  return w.category === 'Default' || w.user_id === userId || w.is_public === true || isAdmin;
}

try {
  const r = await fetch(`${base}/api/v1/workflows/${workflowId}`);
  if (r.status === 403) return loadFallbackPublicWorkflow();
  return await r.json();
} catch (e) { log(e); return null; }

When it happens

Trigger: GET /api/v1/workflows/{workflow_id} in multiuser mode where workflow.workflow.meta.category != Default, workflow.user_id != current_user.user_id, workflow.is_public is false, and current_user.is_admin is false.

Common situations: Sharing workflows between user accounts without marking them public; using a non-admin token for an admin-owned private workflow; upgrading to multiuser mode so previously shared workflows become restricted; tokens for the wrong user cached in automation scripts.

Related errors

• You do not have permission to cancel this queue item
• Only admins can create default presets
• Not authorized to access this system prompt
• Not authorized to update this system prompt
• Not authorized to delete this system prompt

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/4dd436695b0d7faf. Report an issue: GitHub.