invoke-ai/InvokeAI · error · HTTPException

Not authorized to delete this workflow

Error message

Not authorized to delete this workflow

What it means

HTTP 403 raised by delete_workflow when multiuser mode is on and a non-admin user tries to delete a workflow owned by a different user. Existence was already confirmed (a 404 would have fired first); this is purely an authorization failure.

Source

Thrown at invokeai/app/api/routers/workflows.py:120

@workflows_router.delete(
    "/i/{workflow_id}",
    operation_id="delete_workflow",
)
def delete_workflow(
    current_user: CurrentUserOrDefault,
    workflow_id: str = Path(description="The workflow to delete"),
) -> None:
    """Deletes a workflow"""
    try:
        existing = ApiDependencies.invoker.services.workflow_records.get(workflow_id)
    except WorkflowNotFoundError:
        raise HTTPException(status_code=404, detail="Workflow not found")

    config = ApiDependencies.invoker.services.configuration
    if config.multiuser:
        if not current_user.is_admin and existing.user_id != current_user.user_id:
            raise HTTPException(status_code=403, detail="Not authorized to delete this workflow")
    try:
        ApiDependencies.invoker.services.workflow_thumbnails.delete(workflow_id)
    except WorkflowThumbnailFileNotFoundException:
        # It's OK if the workflow has no thumbnail file. We can still delete the workflow.
        pass
    user_id = None if current_user.is_admin else current_user.user_id
    ApiDependencies.invoker.services.workflow_records.delete(workflow_id, user_id=user_id)
    ApiDependencies.invoker.services.events.emit_workflow_deleted(
        workflow_id=existing.workflow_id,
        user_id=existing.user_id,
        is_public=existing.is_public,
    )


@workflows_router.post(
    "/",
    operation_id="create_workflow",
    responses={

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Delete as an admin account
2. Only delete workflows your own user created (filter list by owner in the UI)
3. Disable multiuser if the deployment is effectively single-user
4. Have an admin delete it or transfer ownership in the DB

Example fix

// before
await api.delete(`/workflows/i/${anyVisibleWorkflowId}`); // 403
// after
const all = await api.get('/workflows/').then(r=>r.json());
const mine = all.filter(w => w.user_id === myUserId); // delete only owned workflows

const wf = await fetch(`/api/v1/workflows/i/${id}`).then(r=>r.json());
if (wf.user_id !== myUserId && !isAdmin) throw new Error('Not authorized to delete this workflow');

function canModify(wf, user) { return user.is_admin || wf.user_id === user.user_id; }

try { await deleteWorkflow(id); } catch (e) { if (e?.status === 403) notify('Owned by another user'); else throw e; }

When it happens

Trigger: DELETE /workflows/i/{workflow_id} with config.multiuser=true, current_user.is_admin=false, and existing.user_id != current_user.user_id.

Common situations: Shared InvokeAI server where users attempt to clean up colleagues' workflows; scripts running with a non-admin token after workflows were reassigned; UI listing public workflows from other users that look deletable.

Related errors

• Not authorized to update this workflow
• Only admins can create default presets
• Not authorized to access this system prompt
• Not authorized to update this system prompt
• Not authorized to delete this system prompt

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/952e4681d7feeb22. Report an issue: GitHub.