{"record":{"id":"e28c7c4a64d91aa6","repo":"Significant-Gravitas/AutoGPT","slug":"builder-graph-id-and-expert-id-are-mutually-exclus","errorCode":null,"errorMessage":"builder_graph_id and expert_id are mutually exclusive","messagePattern":"builder_graph_id and expert_id are mutually exclusive","errorType":"http","errorClass":"HTTPException","httpStatus":422,"severity":"warning","filePath":"autogpt_platform/backend/backend/api/features/chat/routes.py","lineNumber":672,"sourceCode":"      the bound graph) and a small blacklist hides tools that conflict\n      with the panel's scope (see :data:`BUILDER_BLOCKED_TOOLS`).\n\n    Args:\n        user_id: The authenticated user ID parsed from the JWT (required).\n        request: Optional request body with ``dry_run``,\n            ``builder_graph_id`` and/or ``expert_id``.\n\n    Returns:\n        CreateSessionResponse: Details of the resulting session.\n    \"\"\"\n    dry_run = request.dry_run if request else False\n    builder_graph_id = request.builder_graph_id if request else None\n    expert_id = request.expert_id if request else None\n\n    # The builder branch below ignores expert_id, so accepting both would\n    # validate the expert and then silently drop the scoping. Reject upfront.\n    if builder_graph_id and expert_id:\n        raise HTTPException(\n            status_code=422,\n            detail=\"builder_graph_id and expert_id are mutually exclusive\",\n        )\n\n    if expert_id is not None:\n        expert = await experts_db.get_expert(user_id, expert_id)\n        if expert is None or expert.is_archived:\n            raise HTTPException(status_code=404, detail=\"Expert not found\")\n\n    llm_auth_provider, llm_credential_id = await _resolve_new_session_llm_route(\n        user_id, request\n    )\n\n    if llm_auth_provider == \"platform\":\n        await enforce_payment_paywall(user_id)\n\n    logger.info(\n        f\"Creating session with user_id: \"","sourceCodeStart":654,"sourceCodeEnd":690,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/chat/routes.py#L654-L690","documentation":"A 422 from create_session: the request passed both builder_graph_id and expert_id. These scoping options are mutually exclusive because the builder branch ignores expert_id entirely — accepting both would validate an expert and then silently drop the scoping, so the route rejects the combination upfront.","triggerScenarios":"POST /chat/sessions with a body containing both builder_graph_id and expert_id (both truthy strings).","commonSituations":"Client state leaking: user opened a builder-agent chat but an expert id from a previous selection stays in the shared form; a generic createSession(payload) helper merges stale fields; API consumers assuming ids can be combined for tighter scoping.","solutions":["Send exactly one scoping field: builder_graph_id for a builder/deployment chat, or expert_id for an expert chat — never both.","Fix the client to reset expert_id when a builder graph is selected (and vice versa).","If merging partial payloads client-side, make the two ids mutually exclusive keys in the request builder."],"exampleFix":"// before\ncreateSession({builder_graph_id: g, expert_id: e})\n\n// after\ncreateSession({builder_graph_id: g, expert_id: undefined})","handlingStrategy":"validation","validationCode":"if (builderGraphId && expertId) throw new Error('pick one: builder_graph_id or expert_id');\nawait createSession(builderGraphId ? {builder_graph_id: builderGraphId} : {expert_id: expertId});","typeGuard":"function isExclusiveScoping(b?: string, e?: string): boolean {\n  return !(b && e);\n}","tryCatchPattern":null,"preventionTips":["Clear expert_id when a builder graph is selected and vice versa.","Build payloads per chat type instead of merging shared state."],"tags":["backend","chat","session-creation","validation","http-422"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}