invoke-ai/InvokeAI · error · HTTPException

Not authorized to update this board

Error message

Not authorized to update this board

What it means

HTTP 403 from PATCH /boards/{board_id} raised after the board is fetched but the caller is neither an admin nor the board's owner (board.user_id != current_user.user_id). Update rights are restricted to owner or admin regardless of board visibility.

Source

Thrown at invokeai/app/api/routers/boards.py:112

            "description": "The board was updated successfully",
        },
    },
    status_code=201,
    response_model=BoardDTO,
)
def update_board(
    current_user: CurrentUserOrDefault,
    board_id: str = Path(description="The id of board to update"),
    changes: BoardChanges = Body(description="The changes to apply to the board"),
) -> BoardDTO:
    """Updates a board (user must have access to it)"""
    try:
        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
    except Exception:
        raise HTTPException(status_code=404, detail="Board not found")

    if not current_user.is_admin and board.user_id != current_user.user_id:
        raise HTTPException(status_code=403, detail="Not authorized to update this board")

    try:
        result = ApiDependencies.invoker.services.boards.update(board_id=board_id, changes=changes)
        return result
    except Exception:
        raise HTTPException(status_code=500, detail="Failed to update board")


@boards_router.delete("/{board_id}", operation_id="delete_board", response_model=DeleteBoardResult)
def delete_board(
    current_user: CurrentUserOrDefault,
    board_id: str = Path(description="The id of board to delete"),
    include_images: Optional[bool] = Query(
        description="Permanently delete all images and videos on the board", default=False
    ),
) -> DeleteBoardResult:
    """Deletes a board (user must have access to it)"""
    try:

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Perform the update with the owner account or an admin
2. Have an admin grant the change, or transfer/recreate the board under the right user
3. Verify the auth token belongs to the intended user
4. Adjust automation to only mutate boards owned by its credentials

Example fix

// before
await api.patch(`/boards/${boardId}`, changes); // 403 if not owner
// after
const board = await api.get(`/boards/${boardId}`);
if (board.user_id !== myUserId) throw new Error('Only the board owner can update this board');
await api.patch(`/boards/${boardId}`, changes);

const board = await api.get(`/boards/${boardId}`);
const me = await api.get('/users/current'); // or your auth introspection
if (!me.is_admin && board.user_id !== me.user_id) throw new Error('not authorized to update this board');

const isForbidden = (e) => e?.response?.status === 403;

try {
  return await api.patch(`/boards/${boardId}`, changes);
} catch (e) {
  if (isForbidden(e)) throw new Error(`user is not owner/admin of board ${boardId}`);
  throw e;
}

When it happens

Trigger: PATCH /boards/{board_id} (rename, visibility change, cover image) authenticated as a non-owner non-admin user, e.g. a shared-board contributor trying to rename someone else's board.

Common situations: Multi-user deployments where collaborators attempt to edit a shared board's metadata, or automation configured with a service account that isn't the owner.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized to access this board
• Not authorized to delete this board
• Not authorized to access this download
• You do not have permission to delete this queue item
• You do not have permission to cancel this queue item

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/97fed9540b930a4b. Report an issue: GitHub.