invoke-ai/InvokeAI · error · HTTPException

Not authorized to modify this board

Error message

Not authorized to modify this board

What it means

After confirming the board exists, _assert_board_write_access raises HTTP 403 unless the caller is an admin, the board owner, or the board has BoardVisibility.Public. It gates add_video_to_board / remove_video_from_board, so users cannot mutate boards they do not own unless the boards accept public contributions.

Source

Thrown at invokeai/app/api/routers/videos.py:145

def _assert_board_write_access(board_id: str, current_user: CurrentUserOrDefault) -> None:
    """Raise 403 if the current user may not mutate the given board.

    Mirrors _assert_board_write_access in board_images.py: admins and the board owner
    may write; public boards accept contributions from any user.
    """
    from invokeai.app.services.board_records.board_records_common import BoardVisibility

    try:
        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
    except Exception:
        raise HTTPException(status_code=404, detail="Board not found")
    if current_user.is_admin:
        return
    if board.user_id == current_user.user_id:
        return
    if board.board_visibility == BoardVisibility.Public:
        return
    raise HTTPException(status_code=403, detail="Not authorized to modify this board")


def _assert_video_read_access(video_name: str, current_user: CurrentUserOrDefault) -> None:
    """Raise 403 if the current user may not view the video."""
    from invokeai.app.services.board_records.board_records_common import (
        BoardRecordNotFoundException,
        BoardVisibility,
    )

    if current_user.is_admin:
        return
    owner = ApiDependencies.invoker.services.video_records.get_user_id(video_name)
    if owner is not None and owner == current_user.user_id:
        return

    board_id = ApiDependencies.invoker.services.board_video_records.get_board_for_video(video_name)
    if board_id is not None:
        # See `assert_image_read_access`: only a board positively known to be gone may fall

View on GitHub (pinned to 0b6a024f2f)

Solutions

  1. Set the board's visibility to Public if contributions from all users are intended, or have the board owner perform the change
  2. Use an admin account/token for cross-user board mutations
  3. Ask the board owner to change visibility or add the video themselves
  4. Verify the board's user_id and board_visibility via GET /api/v1/boards/{board_id} before calling
Defensive patterns

Strategy: validation

Validate before calling

b = requests.get(f"{base}/api/v1/boards/{board_id}").json()
assert is_admin or b["user_id"] == my_user_id or b["board_visibility"] == "Public", "no write access"

Try / catch

try:
    requests.post(f"{base}/api/v1/videos/{name}/board", json={"board_id": board_id}).raise_for_status()
except requests.HTTPError as e:
    if e.response.status_code == 403:
        request_access_or_use_own_board(board_id)

Prevention

When it happens

Trigger: Adding/removing a video to/from a board owned by another user in multiuser mode where that board's visibility is Private (or Shared — only Public grants write).

Common situations: Multiuser installs where users try to organize into shared boards; expecting 'Shared' visibility to allow writes (it does not, only reads per _assert_video_read_access semantics); non-admin service tokens operating across accounts.

Related errors

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/46ff07229a8dd60c. Report an issue: GitHub.