invoke-ai/InvokeAI · warning · HTTPException

Not authorized to update this system prompt

Error message

Not authorized to update this system prompt

What it means

HTTP 403 raised in update_system_prompt when multiuser mode is on and the authenticated user is not an admin and not the owner (existing.user_id != current_user.user_id). Enforced at invokeai/app/api/routers/system_prompts.py:91 before attempting the update.

Source

Thrown at invokeai/app/api/routers/system_prompts.py:91

@system_prompts_router.patch(
    "/i/{system_prompt_id}",
    operation_id="update_system_prompt",
    responses={200: {"model": SystemPromptRecordDTO}},
)
def update_system_prompt(
    current_user: CurrentUserOrDefault,
    system_prompt_id: str = Path(description="The id of the system prompt to update"),
    changes: SystemPromptChanges = Body(description="The changes to apply"),
) -> SystemPromptRecordDTO:
    """Updates a system prompt. Only the owner or an admin may update."""
    config = ApiDependencies.invoker.services.configuration
    if config.multiuser:
        try:
            existing = ApiDependencies.invoker.services.system_prompt_records.get(system_prompt_id)
        except SystemPromptNotFoundError:
            raise HTTPException(status_code=404, detail="System prompt not found")
        if not current_user.is_admin and existing.user_id != current_user.user_id:
            raise HTTPException(status_code=403, detail="Not authorized to update this system prompt")
    user_id = None if current_user.is_admin else current_user.user_id
    try:
        return ApiDependencies.invoker.services.system_prompt_records.update(system_prompt_id, changes, user_id=user_id)
    except SystemPromptNotFoundError:
        raise HTTPException(status_code=404, detail="System prompt not found")


@system_prompts_router.delete(
    "/i/{system_prompt_id}",
    operation_id="delete_system_prompt",
)
def delete_system_prompt(
    current_user: CurrentUserOrDefault,
    system_prompt_id: str = Path(description="The id of the system prompt to delete"),
) -> None:
    """Deletes a system prompt. Only the owner or an admin may delete."""
    config = ApiDependencies.invoker.services.configuration
    if config.multiuser:

View on GitHub (pinned to 0b6a024f2f)

Solutions

1. Log in as the prompt owner or use an admin token
2. Have an admin perform the update
3. Copy the prompt, modify the copy, and create it under your own account
4. Disable multiuser mode if per-user isolation is not desired

Example fix

null

const target = await api.getSystemPrompt(id); // may itself 403/404
if (target.user_id !== currentUser.user_id && !currentUser.is_admin) {
  throw new Error('Current user cannot update this prompt');
}

function canUpdatePrompt(prompt, user) {
  return user.is_admin === true || prompt.user_id === user.user_id;
}

null

When it happens

Trigger: PUT/PATCH /system_prompts/i/{system_prompt_id} with config.multiuser=true, prompt exists, but the caller's user_id differs from existing.user_id and the caller lacks is_admin.

Common situations: Two users in a shared InvokeAI instance trying to edit each other's prompts; service account token used instead of the owner's token; user assumed admin privileges they don't have.

Related errors

• Not authorized to access this system prompt
• Not authorized to delete this system prompt
• You do not have permission to delete this queue item
• Only admins can create default presets
• Not authorized to modify this video

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/2f8f347d4f6e6cdc. Report an issue: GitHub.