Significant-Gravitas/AutoGPT · error · HTTPException

Not found

Error message

Not found

What it means

First uniform 404 of the public shared-file download endpoint: the single-query allowlist check `get_shared_execution_file(share_token, file_id)` found no record pairing that file with that share token. The endpoint deliberately returns an identical 'Not found' for every failure mode to prevent token/file enumeration, so this covers wrong file_id, file not exposed when sharing was enabled, and mismatched share_token.

Source

Thrown at autogpt_platform/backend/backend/api/features/v1.py:2385

        str,
        Path(pattern=SHARE_TOKEN_PATTERN),
    ],
    file_id: Annotated[
        str,
        Path(pattern=SHARE_TOKEN_PATTERN),
    ],
) -> Response:
    """Download a workspace file from a shared execution (no auth required).

    Validates that the file was explicitly exposed when sharing was enabled.
    Returns a uniform 404 for all failure modes to prevent enumeration attacks.
    """
    # Single-query validation against the allowlist
    execution_id = await execution_db.get_shared_execution_file(
        share_token=share_token, file_id=file_id
    )
    if not execution_id:
        raise HTTPException(status_code=404, detail="Not found")

    # Look up the actual file (no workspace scoping needed — the allowlist
    # already validated that this file belongs to the shared execution)
    file = await get_workspace_file_by_id(file_id)
    if not file:
        raise HTTPException(status_code=404, detail="Not found")

    return await create_file_download_response(file, inline=True)


########################################################
##################### Schedules ########################
########################################################


class ScheduleCreationRequest(pydantic.BaseModel):
    graph_version: Optional[int] = None
    name: str

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Only download file IDs that appear in the shared execution's outputs (GET /v1/public/shared/{token} first).
2. If a newer output file is needed, the owner must disable and re-enable sharing so the allowlist is rebuilt from current outputs.
3. Do not attempt to enumerate file IDs — every miss returns the same 404 by design.

const shared = await api.getSharedExecution(token);
const allowed = new Set(collectFileIds(shared.outputs)); // ids exposed at share time
if (!allowed.has(fileId)) { show('This file is not part of the shared execution'); return; }

try {
  const blob = await api.downloadSharedFile(token, fileId);
} catch (e) {
  if (e.status === 404) { show('File not available in this share'); return; }
  throw e;
}

When it happens

Trigger: GET /v1/public/shared/{share_token}/files/{file_id}/download where file_id is not in the shared-execution file allowlist for that token — e.g. a workspace file produced after sharing was enabled, a file from a different execution, or a guessed file_id.

Common situations: Execution produced new output files after the share was created (only files present in execution.outputs at share time are allowlisted); consumers scraping file IDs from elsewhere in the API; stale links after re-sharing.

Related errors

• Shared execution not found
• Execution not found
• Graph #{graph_id} not found.
• Execution not found or not in QUEUED status
• Execution not found

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/a681dcc541f30159. Report an issue: GitHub.