invoke-ai/InvokeAI · warning · HTTPException

Not authorized to delete this system prompt

Error message

Not authorized to delete this system prompt

What it means

HTTP 403 raised in delete_system_prompt when multiuser is enabled and the caller is neither admin nor owner (existing.user_id != current_user.user_id), enforced at invokeai/app/api/routers/system_prompts.py:115 before deletion.

Source

Thrown at invokeai/app/api/routers/system_prompts.py:115

@system_prompts_router.delete(
    "/i/{system_prompt_id}",
    operation_id="delete_system_prompt",
)
def delete_system_prompt(
    current_user: CurrentUserOrDefault,
    system_prompt_id: str = Path(description="The id of the system prompt to delete"),
) -> None:
    """Deletes a system prompt. Only the owner or an admin may delete."""
    config = ApiDependencies.invoker.services.configuration
    if config.multiuser:
        try:
            existing = ApiDependencies.invoker.services.system_prompt_records.get(system_prompt_id)
        except SystemPromptNotFoundError:
            raise HTTPException(status_code=404, detail="System prompt not found")
        if not current_user.is_admin and existing.user_id != current_user.user_id:
            raise HTTPException(status_code=403, detail="Not authorized to delete this system prompt")
    user_id = None if current_user.is_admin else current_user.user_id
    try:
        ApiDependencies.invoker.services.system_prompt_records.delete(system_prompt_id, user_id=user_id)
    except SystemPromptNotFoundError:
        raise HTTPException(status_code=404, detail="System prompt not found")

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Use an admin token for cross-user cleanup scripts
2. Run the deletion as the prompt owner
3. Have an admin grant the account admin privileges if appropriate
4. Disable multiuser if per-user ownership boundaries are not needed

Example fix

null

const target = await api.getSystemPrompt(id);
if (target.user_id !== currentUser.user_id && !currentUser.is_admin) {
  throw new Error(`User ${currentUser.user_id} cannot delete prompt owned by ${target.user_id}`);
}

function canDeletePrompt(prompt, user) {
  return user.is_admin === true || prompt.user_id === user.user_id;
}

null

When it happens

Trigger: DELETE /system_prompts/i/{system_prompt_id} with config.multiuser=true, prompt exists, caller's user_id differs from existing.user_id and is_admin is false.

Common situations: Cleanup scripts running under a non-admin service account trying to delete other users' prompts; users deleting teammates' prompts in a shared instance.

Related errors

• Not authorized to access this system prompt
• Not authorized to update this system prompt
• You do not have permission to delete this queue item
• Only admins can create default presets
• Not authorized to modify this video

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/fd9cdfe83d63f9e8. Report an issue: GitHub.