{"record":{"id":"b3902d8cc5e9d9fd","repo":"langflow-ai/langflow","slug":"cannot-transfer-ownership-of-a-flow-you-do-not-own","errorCode":null,"errorMessage":"Cannot transfer ownership of a flow you do not own.","messagePattern":"Cannot transfer ownership of a flow you do not own\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"src/backend/base/langflow/api/v1/flows_helpers.py","lineNumber":425,"sourceCode":"    owner_user_id: UUID = existing_flow.user_id\n    is_owner_edit = owner_user_id == actor_user_id\n\n    # Non-owner edits cannot relocate the flow into folders or storage they\n    # own, nor transfer ownership. Reject early so the failure is explicit\n    # rather than corrupting scope downstream.\n    if not is_owner_edit:\n        if flow.folder_id is not None and flow.folder_id != existing_flow.folder_id:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change folder of a flow you do not own.\",\n            )\n        if flow.fs_path is not None and flow.fs_path != existing_flow.fs_path:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change fs_path of a flow you do not own.\",\n            )\n        if flow.user_id is not None and flow.user_id != owner_user_id:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot transfer ownership of a flow you do not own.\",\n            )\n        # ``a2a_enabled`` defaults to False (not None) on FlowCreate, so gate on\n        # model_fields_set to block only an explicit, differing change.\n        if \"a2a_enabled\" in flow.model_fields_set and flow.a2a_enabled != existing_flow.a2a_enabled:\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change a2a_enabled of a flow you do not own.\",\n            )\n        if (\n            \"a2a_card_overrides\" in flow.model_fields_set\n            and flow.a2a_card_overrides != existing_flow.a2a_card_overrides\n        ):\n            raise HTTPException(\n                status_code=403,\n                detail=\"Cannot change a2a_card_overrides of a flow you do not own.\",\n            )","sourceCodeStart":407,"sourceCodeEnd":443,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/flows_helpers.py#L407-L443","documentation":"HTTP 403 from _update_flow: a non-owner edit supplies a user_id different from the flow's owner — an attempted ownership transfer. Ownership transfer is owner-only; the create path likewise ignores body user_id, so this guard closes the update-side hole.","triggerScenarios":"PATCH/PUT by a non-owner with {\"user_id\": \"<their-own-or-third uuid>\"} in the body.","commonSituations":"Admin tooling tries to reassign flows between users via the normal update endpoint; clients echo the full flow representation back including user_id; org restructures where someone attempts bulk reassignment without owner credentials.","solutions":["Omit user_id from update payloads entirely.","For genuine ownership transfer, use an admin/superuser transfer mechanism or export+import under the new owner.","Strip echo-back fields (user_id, id) in client update payloads."],"exampleFix":"# before\n{\"name\": \"f\", \"user_id\": \"<new-owner-uuid>\"}\n# after\n{\"name\": \"f\"}","handlingStrategy":"validation","validationCode":"delete body.user_id; // never send user_id on update","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never include user_id in PATCH/PUT flow payloads","Use export/import for genuine ownership transfer","Strip echo-back identity fields in clients"],"tags":["authorization","ownership","http-403","flows","security"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}