{"record":{"id":"bd922cd0b8f9123e","repo":"langflow-ai/langflow","slug":"flow-not-found-bd922c","errorCode":null,"errorMessage":"Flow not found.","messagePattern":"Flow not found\\.","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"src/backend/base/langflow/agentic/api/router.py","lineNumber":160,"sourceCode":"\n    A missing flow_id is allowed (the assistant runs with no canvas context).\n    A supplied id must reference a flow the caller can access, mirroring the\n    per-user 404 of the /run and webhook endpoints; not-found and cross-user\n    both surface 404 so a flow's existence is not leaked by id.\n    \"\"\"\n    if not flow_id:\n        return\n\n    from langflow.services.database.models.flow import Flow\n\n    try:\n        flow_uuid = UUID(flow_id)\n    except ValueError as exc:\n        raise HTTPException(status_code=422, detail=\"Invalid flow_id: not a valid UUID.\") from exc\n\n    flow = await session.get(Flow, flow_uuid)\n    if flow is None or (flow.user_id is not None and str(flow.user_id) != str(user_id)):\n        raise HTTPException(status_code=404, detail=\"Flow not found.\")\n\n\n@router.post(\"/execute/{flow_name}\", dependencies=[Depends(require_agentic_experience)])\nasync def execute_named_flow(\n    flow_name: str,\n    request: AssistantRequest,\n    current_user: CurrentActiveUser,\n    session: DbSession,\n) -> dict:\n    \"\"\"Execute a named flow from the flows directory.\n\n    Named assistant flows embed an Agent that needs provider/model/api-key\n    context. Resolving it here (instead of running the raw file) turns a\n    silent 500 into a successful run, or a clear 4xx when no provider is set.\n    \"\"\"\n    ctx = await _resolve_assistant_context(request, current_user.id, session)\n\n    global_vars = dict(ctx.global_vars)","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/agentic/api/router.py#L142-L178","documentation":"Raised by _validate_flow_access when the supplied flow_id parses as a UUID but no Flow row with that id exists, or the row belongs to a different user. Not-found and cross-user access deliberately share the same 404 so that flow existence is not leaked by id probing. This mirrors the per-user 404 behavior of the /run and webhook endpoints.","triggerScenarios":"POST /api/v1/agentic/assist* with a flow_id that is a well-formed UUID but deleted, never existed, or owned by another user; also flows whose user_id differs from the authenticated CurrentActiveUser.","commonSituations":"Flow deleted after the client captured its id; sharing a flow id between accounts and expecting cross-user access without the authorization plugin; stale local storage in the frontend holding an old flow id; database reset wiping flows while the session kept the id.","solutions":["Re-fetch the caller's flows (GET /api/v1/flows) and use an id from that list.","If the flow was deleted, recreate it or clear the stored flow_id so the assistant runs without canvas context.","For genuine cross-user sharing, enable the RBAC authorization layer with a plugin that supports cross-user fetch instead of relying on the OSS pass-through.","Confirm you are authenticated as the same user that owns the flow (token from the right account)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Only send flow_ids the caller can actually see\nconst flows = await fetch('/api/v1/flows').then(r => r.json());\nconst owned = new Set(flows.map(f => f.id));\nif (flowId && !owned.has(flowId)) flowId = undefined;","typeGuard":null,"tryCatchPattern":"Treat 404 as terminal for that flow_id: clear cached id, refresh the flow list, and either retry with a fresh id or proceed without flow_id. Do not blind-retry the same id.","preventionTips":["Cache flow ids with a TTL and refresh after deletions or workspace switches.","Design UX so a 404 clears the selected flow rather than looping.","Remember 404 deliberately hides cross-user flows — do not attempt id enumeration."],"tags":["agentic","flow","http-404","authorization","multi-tenant"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}