langflow-ai/langflow · error · HTTPException

Cannot change a2a_enabled of a flow you do not own.

Error message

Cannot change a2a_enabled of a flow you do not own.

What it means

HTTP 403 from _update_flow: a non-owner edit explicitly sets a2a_enabled to a value differing from the stored one. Because FlowCreate defaults a2a_enabled to False (not None), the guard keys on model_fields_set so only an explicit, differing change is blocked — echoing the current value is fine.

Source

Thrown at src/backend/base/langflow/api/v1/flows_helpers.py:432

        if flow.folder_id is not None and flow.folder_id != existing_flow.folder_id:
            raise HTTPException(
                status_code=403,
                detail="Cannot change folder of a flow you do not own.",
            )
        if flow.fs_path is not None and flow.fs_path != existing_flow.fs_path:
            raise HTTPException(
                status_code=403,
                detail="Cannot change fs_path of a flow you do not own.",
            )
        if flow.user_id is not None and flow.user_id != owner_user_id:
            raise HTTPException(
                status_code=403,
                detail="Cannot transfer ownership of a flow you do not own.",
            )
        # ``a2a_enabled`` defaults to False (not None) on FlowCreate, so gate on
        # model_fields_set to block only an explicit, differing change.
        if "a2a_enabled" in flow.model_fields_set and flow.a2a_enabled != existing_flow.a2a_enabled:
            raise HTTPException(
                status_code=403,
                detail="Cannot change a2a_enabled of a flow you do not own.",
            )
        if (
            "a2a_card_overrides" in flow.model_fields_set
            and flow.a2a_card_overrides != existing_flow.a2a_card_overrides
        ):
            raise HTTPException(
                status_code=403,
                detail="Cannot change a2a_card_overrides of a flow you do not own.",
            )

    # Validate fs_path if provided (use `is not None` to catch empty strings).
    # Path safety is scoped to the *owner* — fs_path lives under the owner's
    # storage namespace, so we must not authorize it against the actor's.
    if flow.fs_path is not None:
        await _verify_fs_path(flow.fs_path, owner_user_id, storage_service)

View on GitHub (pinned to 976ec789d2)

Solutions

1. Omit a2a_enabled from non-owner updates.
2. Echo the current value if your client must send the full object (no error when equal).
3. Route A2A enablement requests to the flow owner.

Example fix

# before
{"a2a_enabled": true}   # non-owner on a flow where it is false
# after
{}                        # omit; owner enables A2A

if (!isOwner && 'a2a_enabled' in body && body.a2a_enabled !== currentFlow.a2a_enabled) delete body.a2a_enabled;

When it happens

Trigger: PATCH/PUT by a non-owner whose body includes a2a_enabled with a value != existing_flow.a2a_enabled (e.g. enabling Agent-to-Agent exposure on someone else's flow).

Common situations: A teammate with edit-via-plugin rights toggling A2A exposure on flows they do not own; automation that flips a2a_enabled globally across many flows owned by different users.

Related errors

• Cannot change a2a_card_overrides of a flow you do not own.
• Cannot change folder of a flow you do not own.
• Cannot change fs_path of a flow you do not own.
• Superuser required to administer role assignments.
• Superuser required to administer roles.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/f3eb1042717915b8. Report an issue: GitHub.