invoke-ai/InvokeAI · error · HTTPException

Not authorized to move this video

Error message

Not authorized to move this video

What it means

_assert_video_direct_owner raises HTTP 403 unless the current user is an admin or the direct owner of the video record. Unlike _assert_video_owner it deliberately ignores board-ownership and public-board fallbacks, so board-move operations (add/remove video to/from board) can only be performed by the original owner — preventing a user from moving someone else's video onto their own board.

Source

Thrown at invokeai/app/api/routers/videos.py:124

            pass

    raise HTTPException(status_code=403, detail="Not authorized to modify this video")


def _assert_video_direct_owner(video_name: str, current_user: CurrentUserOrDefault) -> None:
    """Raise 403 if the current user is not the direct owner of the video.

    Intentionally stricter than _assert_video_owner: board-ownership and public-board
    fallbacks are NOT honored. Mirrors _assert_image_direct_owner in board_images.py —
    board-move operations need to verify the *original* owner, otherwise a user could
    move someone else's video onto their own board via the board-owner branch.
    """
    if current_user.is_admin:
        return
    owner = ApiDependencies.invoker.services.video_records.get_user_id(video_name)
    if owner is not None and owner == current_user.user_id:
        return
    raise HTTPException(status_code=403, detail="Not authorized to move this video")


def _assert_board_write_access(board_id: str, current_user: CurrentUserOrDefault) -> None:
    """Raise 403 if the current user may not mutate the given board.

    Mirrors _assert_board_write_access in board_images.py: admins and the board owner
    may write; public boards accept contributions from any user.
    """
    from invokeai.app.services.board_records.board_records_common import BoardVisibility

    try:
        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
    except Exception:
        raise HTTPException(status_code=404, detail="Board not found")
    if current_user.is_admin:
        return
    if board.user_id == current_user.user_id:
        return

View on GitHub (pinned to 0b6a024f2f)

Solutions

  1. Have the original video owner perform the board move
  2. Use an admin account for the operation
  3. If delegation is needed, have the owner re-upload the video so it becomes owned by the intended user
  4. Do not rely on public-board visibility for move operations — it is intentionally not honored
Defensive patterns

Strategy: try-catch

Validate before calling

owner = requests.get(f"{base}/api/v1/videos/{name}").json().get("user_id")
assert owner == my_user_id or is_admin, "direct-owner move not permitted"

Try / catch

try:
    requests.post(f"{base}/api/v1/videos/{name}/board", json={"board_id": board}).raise_for_status()
except requests.HTTPError as e:
    if e.response.status_code == 403:
        ask_owner_to_move(name)

Prevention

When it happens

Trigger: POST /api/v1/videos/{video}/board or DELETE removing a video from a board in multiuser mode, where the caller is not the video's original owner (even if they own the target board or the video sits on a public board).

Common situations: A user tries to reorganize videos shared on a public/shared board into their own boards; admin-delegated scripts running as a non-admin token; assuming board ownership grants move rights.

Related errors

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/7560cb5e31ddc3d1. Report an issue: GitHub.