invoke-ai/InvokeAI · error · HTTPException

Not authorized to update this board

Error message

Not authorized to update this board

What it means

HTTP 403 from PATCH /boards/{board_id} raised after the board is fetched but the caller is neither an admin nor the board's owner (board.user_id != current_user.user_id). Update rights are restricted to owner or admin regardless of board visibility.

Solutions

1. Perform the update with the owner account or an admin
2. Have an admin grant the change, or transfer/recreate the board under the right user
3. Verify the auth token belongs to the intended user
4. Adjust automation to only mutate boards owned by its credentials

Example fix

// before
await api.patch(`/boards/${boardId}`, changes); // 403 if not owner
// after
const board = await api.get(`/boards/${boardId}`);
if (board.user_id !== myUserId) throw new Error('Only the board owner can update this board');
await api.patch(`/boards/${boardId}`, changes);

const board = await api.get(`/boards/${boardId}`);
const me = await api.get('/users/current'); // or your auth introspection
if (!me.is_admin && board.user_id !== me.user_id) throw new Error('not authorized to update this board');

const isForbidden = (e) => e?.response?.status === 403;

try {
  return await api.patch(`/boards/${boardId}`, changes);
} catch (e) {
  if (isForbidden(e)) throw new Error(`user is not owner/admin of board ${boardId}`);
  throw e;
}

When it happens

Trigger: PATCH /boards/{board_id} (rename, visibility change, cover image) authenticated as a non-owner non-admin user, e.g. a shared-board contributor trying to rename someone else's board.

Common situations: Multi-user deployments where collaborators attempt to edit a shared board's metadata, or automation configured with a service account that isn't the owner.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Not authorized to access this board
• Not authorized to access this download
• Not authorized to access this style preset
• Not authorized to delete this board
• Not authorized to modify this board

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/97fed9540b930a4b. Report an issue: GitHub.

Appendix: source

Thrown at invokeai/app/api/routers/boards.py:112

            "description": "The board was updated successfully",
        },
    },
    status_code=201,
    response_model=BoardDTO,
)
def update_board(
    current_user: CurrentUserOrDefault,
    board_id: str = Path(description="The id of board to update"),
    changes: BoardChanges = Body(description="The changes to apply to the board"),
) -> BoardDTO:
    """Updates a board (user must have access to it)"""
    try:
        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
    except Exception:
        raise HTTPException(status_code=404, detail="Board not found")

    if not current_user.is_admin and board.user_id != current_user.user_id:
        raise HTTPException(status_code=403, detail="Not authorized to update this board")

    try:
        result = ApiDependencies.invoker.services.boards.update(board_id=board_id, changes=changes)
        return result
    except Exception:
        raise HTTPException(status_code=500, detail="Failed to update board")


@boards_router.delete("/{board_id}", operation_id="delete_board", response_model=DeleteBoardResult)
def delete_board(
    current_user: CurrentUserOrDefault,
    board_id: str = Path(description="The id of board to delete"),
    include_images: Optional[bool] = Query(
        description="Permanently delete all images and videos on the board", default=False
    ),
) -> DeleteBoardResult:
    """Deletes a board (user must have access to it)"""
    try:

View on GitHub (pinned to 0b6a024f2f)