invoke-ai/InvokeAI · error · HTTPException

Not authorized to update this workflow

Error message

Not authorized to update this workflow

What it means

HTTP 403 raised by the update_workflow endpoint in InvokeAI's REST API when multiuser mode is enabled and the authenticated user attempts to update a workflow they do not own. Admins bypass the ownership check. The workflow exists (otherwise a 404 would be raised), but the caller lacks permission.

Source

Thrown at invokeai/app/api/routers/workflows.py:91

    operation_id="update_workflow",
    responses={
        200: {"model": WorkflowRecordDTO},
    },
)
def update_workflow(
    current_user: CurrentUserOrDefault,
    workflow: Workflow = Body(description="The updated workflow", embed=True),
) -> WorkflowRecordDTO:
    """Updates a workflow"""
    try:
        existing = ApiDependencies.invoker.services.workflow_records.get(workflow.id)
    except WorkflowNotFoundError:
        raise HTTPException(status_code=404, detail="Workflow not found")

    config = ApiDependencies.invoker.services.configuration
    if config.multiuser:
        if not current_user.is_admin and existing.user_id != current_user.user_id:
            raise HTTPException(status_code=403, detail="Not authorized to update this workflow")
    user_id = None if current_user.is_admin else current_user.user_id
    updated = ApiDependencies.invoker.services.workflow_records.update(workflow=workflow, user_id=user_id)
    ApiDependencies.invoker.services.events.emit_workflow_updated(
        workflow_id=updated.workflow_id,
        user_id=updated.user_id,
        old_is_public=existing.is_public,
        new_is_public=updated.is_public,
    )
    return updated


@workflows_router.delete(
    "/i/{workflow_id}",
    operation_id="delete_workflow",
)
def delete_workflow(
    current_user: CurrentUserOrDefault,
    workflow_id: str = Path(description="The workflow to delete"),

View on GitHub (pinned to 0b6a024f2f)

Solutions

  1. Log in as an admin user, which bypasses the ownership check
  2. Operate the workflow under the account that owns it (verify existing.user_id matches your user)
  3. Set multiuser=false in invokeai.yaml if single-user operation is intended (e.g. local instance)
  4. Have an admin reassign the workflow's user_id in the database to the requesting user

Example fix

// before
await fetch(`/api/v1/workflows/i/${foreignWorkflowId}`, {method: 'PUT', body: wf}); // 403
// after
const wf = await fetch(`/api/v1/workflows/i/${ownWorkflowId}`).then(r=>r.json());
await fetch(`/api/v1/workflows/i/${wf.workflow_id}`, {method: 'PUT', body: JSON.stringify(wf)});
Defensive patterns

Strategy: validation

Validate before calling

const wf = await fetch(`/api/v1/workflows/i/${id}`).then(r=>r.json());
if (wf.user_id !== myUserId && !isAdmin) throw new Error('Not authorized to update this workflow');

Type guard

function canModify(wf, user) { return user.is_admin || wf.user_id === user.user_id; }

Try / catch

try { await updateWorkflow(id, wf); } catch (e) { if (e?.status === 403) { notify('You do not own this workflow'); } else { throw e; } }

Prevention

When it happens

Trigger: PUT to /workflows/i/{workflow_id} with config.multiuser=true, where workflow.user_id differs from the current_user.user_id and current_user.is_admin is false.

Common situations: Multiuser InvokeAI deployments where a user shares or copies another user's workflow ID and tries to save changes; migrating workflows between user accounts; frontend passing a stale workflow whose user_id changed after a DB migration.

Related errors

AI-assisted analysis of invoke-ai/InvokeAI@0b6a024f2f (2026-08-29). Data as JSON: /api/errors/43714b17381faf43. Report an issue: GitHub.