{"record":{"id":"c8d8cf5b69475881","repo":"langflow-ai/langflow","slug":"str-e-c8d8cf","errorCode":null,"errorMessage":"str(e)","messagePattern":"str\\(e\\)","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"src/backend/base/langflow/api/v1/api_key.py","lineNumber":40,"sourceCode":"    try:\n        user_id = current_user.id\n        api_keys = await get_api_keys(db, user_id)\n        return ApiKeysResponse(total_count=len(api_keys), user_id=user_id, api_keys=api_keys)\n    except Exception as exc:\n        raise HTTPException(status_code=400, detail=str(exc)) from exc\n\n\n@router.post(\"/\", include_in_schema=False)\nasync def create_api_key_route(\n    req: ApiKeyCreate,\n    current_user: CurrentActiveUser,\n    db: DbSession,\n) -> UnmaskedApiKeyRead:\n    try:\n        user_id = current_user.id\n        return await create_api_key(db, req, user_id=user_id)\n    except PermissionError as e:\n        raise HTTPException(status_code=403, detail=str(e)) from e\n    except Exception as e:\n        raise HTTPException(status_code=400, detail=str(e)) from e\n\n\n@router.delete(\"/{api_key_id}\", include_in_schema=False)\nasync def delete_api_key_route(\n    api_key_id: UUID,\n    db: DbSession,\n    current_user: CurrentActiveUser,\n):\n    try:\n        await delete_api_key(db, api_key_id, current_user.id)\n    except Exception as e:\n        raise HTTPException(status_code=400, detail=str(e)) from e\n    return {\"detail\": \"API Key deleted\"}\n\n\n@router.post(\"/store\", include_in_schema=False)","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/api_key.py#L22-L58","documentation":"Raised by POST /api/v1/api_keys/ when create_api_key signals PermissionError — mapped to HTTP 403 with the exception text. Permission at this layer means the authenticated user is not allowed to perform the specific create operation (e.g. restrictions enforced by the service layer such as creating keys on behalf of another user, or policy plug-ins denying key creation), distinct from authentication failure which the CurrentActiveUser dependency handles with 401.","triggerScenarios":"POST /api/v1/api_keys/ with an ApiKeyCreate payload that targets another user, exceeds a permitted scope/role the caller may not grant itself, or hits a deployment policy that denies key creation for the account.","commonSituations":"Admin-tooling creating keys with user_id set to someone else while authenticated as a normal user; RBAC/plugin deployments that restrict API-key issuance; attempting to mint a key with elevated scopes the caller lacks.","solutions":["Read the detail text — it states which permission failed","Create the key for yourself (omit the foreign user_id) or authenticate as a user permitted to administer that account","Request the required role/scope grant, or have an admin create the key, rather than retrying the same payload"],"exampleFix":"// before\nPOST /api/v1/api_keys/  {\"name\":\"k\",\"user_id\":\"<other-user-uuid>\"}\n// after\nPOST /api/v1/api_keys/  {\"name\":\"k\"}   // creates for the authenticated user","handlingStrategy":"try-catch","validationCode":"def can_create_for_self(req: dict) -> bool:\n    return not req.get(\"user_id\")  # only admins may pass a foreign user_id","typeGuard":null,"tryCatchPattern":"try:\n    key = client.post(\"/api/v1/api_keys/\", json=payload).raise_for_status().json()\nexcept HTTPStatusError as e:\n    if e.response.status_code == 403:\n        if payload.get(\"user_id\"):\n            payload.pop(\"user_id\")          # retry for self\n            key = client.post(\"/api/v1/api_keys/\", json=payload).raise_for_status().json()\n        else:\n            raise PermissionDenied(e.response.json()[\"detail\"]) from e\n    raise","preventionTips":["Omit user_id unless you are intentionally administering another account","Map 403 here to 'policy denial' — fix authorization, never the payload formatting","Keep admin key-issuance flows separate from end-user self-service flows"],"tags":["api-key","http-403","permissions","rbac"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}