{"record":{"id":"9f83124737886bd0","repo":"langflow-ai/langflow","slug":"flow-not-found-9f8312","errorCode":null,"errorMessage":"Flow not found","messagePattern":"Flow not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"src/backend/base/langflow/api/v1/flow_events.py","lineNumber":42,"sourceCode":"class FlowEventsResponse(BaseModel):\n    events: list[FlowEventResponse]\n    settled: bool\n\n\nclass FlowEventCreate(BaseModel):\n    type: FLOW_EVENT_TYPES\n    summary: str = Field(default=\"\", max_length=500)\n\n\nasync def _verify_flow_owner(session: DbSession, flow_id: UUID, user_id: UUID) -> None:\n    result = await session.exec(\n        select(Flow).where(\n            Flow.id == flow_id,\n            or_(Flow.user_id == user_id, Flow.user_id == None),  # noqa: E711\n        )\n    )\n    if not result.first():\n        raise HTTPException(status_code=404, detail=\"Flow not found\")\n\n\n@router.get(\"/{flow_id}/events\", response_model=FlowEventsResponse)\nasync def get_flow_events(\n    flow_id: UUID,\n    current_user: CurrentActiveUser,\n    session: DbSession,\n    since: Annotated[float, Query(description=\"UTC timestamp to get events after\")] = 0.0,\n    *,\n    service: Annotated[FlowEventsService, Depends(get_flow_events_service)],\n) -> FlowEventsResponse:\n    await _verify_flow_owner(session, flow_id, current_user.id)\n    events, settled = service.get_since(str(flow_id), since)\n    return FlowEventsResponse(\n        events=[FlowEventResponse(type=e.type, timestamp=e.timestamp, summary=e.summary) for e in events],\n        settled=settled,\n    )\n","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/flow_events.py#L24-L60","documentation":"404 from GET /api/v1/flow_events/{flow_id}/events (and sibling endpoints using _verify_flow_owner): no Flow row matches the given flow_id where user_id equals the caller OR user_id IS NULL. The lookup deliberately conflates 'does not exist' and 'not yours' into one 404 so flow ids of other users are not distinguishable from random UUIDs.","triggerScenarios":"Requesting events for a flow id that was deleted, a flow owned by a different user, or a malformed-but-valid UUID that never existed. Also hit when AUTO_LOGIN semantics changed and a flow you expected to be null-owner is actually owned by another auto-created user.","commonSituations":"Stale client-side flow list after the flow was deleted in another tab/session; copying flow ids between environments (dev id used against prod); multi-user deployments where the flow belongs to someone else.","solutions":["Re-fetch the caller's flow list (GET /api/v1/flows/) and confirm the flow_id still exists for this user","If the flow should be shared, have the owner share it or use the authorization plugin's cross-user fetch support instead of this owner-scoped endpoint","If AUTO_LOGIN is on, confirm which user the session maps to — flows created by a different auto-login user are invisible here","Handle 404 by refreshing/expiring the stale flow reference in the UI"],"exampleFix":"// before\nconst events = await getFlowEvents(flowId);\n\n// after: treat 404 as 'gone', refresh the flow list\ntry {\n  const events = await getFlowEvents(flowId);\n} catch (e) {\n  if (e.response?.status === 404) {\n    queryClient.invalidateQueries({ queryKey: ['flows'] });\n    return;\n  }\n  throw e;\n}","handlingStrategy":"validation","validationCode":"const { data: flows } = await axios.get('/api/v1/flows/');\nconst owned = flows.some((f) => f.id === flowId); // only then subscribe to events","typeGuard":null,"tryCatchPattern":"catch (e) {\n  if (e.response?.status === 404) { stopEventPolling(flowId); invalidateFlowsQuery(); return; }\n  throw e;\n}","preventionTips":["Resolve flow_id from the live flows listing before opening long-poll/SSE event streams","Treat 404 on event endpoints as terminal for the session — stop polling instead of retrying","In multi-user setups, verify ownership in the UI before exposing event URLs"],"tags":["http-404","flow-events","ownership","authorization"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}