invoke-ai/InvokeAI · error · HTTPException

Not authorized to modify this video

Error message

Not authorized to modify this video

What it means

_assert_video_owner raises HTTP 403 when the current user is neither an admin, nor the direct owner of the video record, nor the owner of (or a viewer of a Public) board containing the video. Delete/update/star video endpoints call it before mutating, so non-owners cannot modify other tenants' videos.

Source

Thrown at invokeai/app/api/routers/videos.py:108

    if current_user.is_admin:
        return
    owner = ApiDependencies.invoker.services.video_records.get_user_id(video_name)
    if owner is not None and owner == current_user.user_id:
        return

    board_id = ApiDependencies.invoker.services.board_video_records.get_board_for_video(video_name)
    if board_id is not None:
        try:
            board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
            if board.user_id == current_user.user_id:
                return
            if board.board_visibility == BoardVisibility.Public:
                return
        except Exception:
            pass

    raise HTTPException(status_code=403, detail="Not authorized to modify this video")


def _assert_video_direct_owner(video_name: str, current_user: CurrentUserOrDefault) -> None:
    """Raise 403 if the current user is not the direct owner of the video.

    Intentionally stricter than _assert_video_owner: board-ownership and public-board
    fallbacks are NOT honored. Mirrors _assert_image_direct_owner in board_images.py —
    board-move operations need to verify the *original* owner, otherwise a user could
    move someone else's video onto their own board via the board-owner branch.
    """
    if current_user.is_admin:
        return
    owner = ApiDependencies.invoker.services.video_records.get_user_id(video_name)
    if owner is not None and owner == current_user.user_id:
        return
    raise HTTPException(status_code=403, detail="Not authorized to move this video")

View on GitHub (pinned to 0b6a024f2f)

Solutions

  1. Log in as an admin user or use an admin token for cross-tenant video operations
  2. Operate only on videos your user created (verify owner via video DTO before calling)
  3. If the video should be shared, move it to a Public board owned appropriately or have the owner perform the action
  4. Confirm the correct user account/token is being sent — stale auth tokens can resolve to the wrong user
Defensive patterns

Strategy: try-catch

Validate before calling

dto = requests.get(f"{base}/api/v1/videos/{name}")
if dto.status_code != 200:
    raise SkipVideo(name)
# also confirm your token belongs to the owner or an admin

Try / catch

try:
    requests.delete(f"{base}/api/v1/videos/{name}").raise_for_status()
except requests.HTTPError as e:
    if e.response.status_code == 403:
        log.warning(f"no permission to modify video {name}; skipping")

Prevention

When it happens

Trigger: DELETE/PATCH or batch star/delete calls on /api/v1/videos/... for a video owned by another user, in multiuser mode, where the video's board is private, missing, or owned by a third user.

Common situations: Multiuser InvokeAI where a user references another tenant's video names; shared scripts running under a non-admin token; board deleted so the board-ownership fallback cannot grant access (the except: pass branch swallows the lookup error).

Related errors

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/ff75c22778043456. Report an issue: GitHub.