langflow-ai/langflow · error · HTTPException

Cannot change fs_path of a flow you do not own.

Error message

Cannot change fs_path of a flow you do not own.

What it means

HTTP 403 from _update_flow: a non-owner edit attempts to change fs_path to a value different from the stored one. Storage location is part of the flow's scope (fs_path lives under the owner's namespace and is even validated against owner_user_id), so non-owner editors cannot redirect where the flow is persisted.

Source

Thrown at src/backend/base/langflow/api/v1/flows_helpers.py:420

    """
    await lock_flow_for_update(session, existing_flow)

    settings_service = get_settings_service()
    actor_user_id = current_user.id
    owner_user_id: UUID = existing_flow.user_id
    is_owner_edit = owner_user_id == actor_user_id

    # Non-owner edits cannot relocate the flow into folders or storage they
    # own, nor transfer ownership. Reject early so the failure is explicit
    # rather than corrupting scope downstream.
    if not is_owner_edit:
        if flow.folder_id is not None and flow.folder_id != existing_flow.folder_id:
            raise HTTPException(
                status_code=403,
                detail="Cannot change folder of a flow you do not own.",
            )
        if flow.fs_path is not None and flow.fs_path != existing_flow.fs_path:
            raise HTTPException(
                status_code=403,
                detail="Cannot change fs_path of a flow you do not own.",
            )
        if flow.user_id is not None and flow.user_id != owner_user_id:
            raise HTTPException(
                status_code=403,
                detail="Cannot transfer ownership of a flow you do not own.",
            )
        # ``a2a_enabled`` defaults to False (not None) on FlowCreate, so gate on
        # model_fields_set to block only an explicit, differing change.
        if "a2a_enabled" in flow.model_fields_set and flow.a2a_enabled != existing_flow.a2a_enabled:
            raise HTTPException(
                status_code=403,
                detail="Cannot change a2a_enabled of a flow you do not own.",
            )
        if (
            "a2a_card_overrides" in flow.model_fields_set
            and flow.a2a_card_overrides != existing_flow.a2a_card_overrides

View on GitHub (pinned to 976ec789d2)

Solutions

1. Omit fs_path from non-owner updates.
2. Send fs_path exactly equal to the current value if your client echoes it back, or strip it from the payload.
3. Have the owner perform any storage relocation.

Example fix

// before — client echoes every field
body = {...flow, fs_path: myPath};
// after
if (!isOwner) delete body.fs_path;

if (!isOwner && 'fs_path' in body && body.fs_path !== currentFlow.fs_path) delete body.fs_path;

When it happens

Trigger: PATCH/PUT by a non-owner (plugin-authorized editor or service account) whose payload includes an fs_path different from existing_flow.fs_path.

Common situations: A shared/team flow where an editor tries to move persistence to their own directory; sync tooling running as a service account that blindly includes fs_path on every update.

Related errors

• Cannot change folder of a flow you do not own.
• Cannot change a2a_enabled of a flow you do not own.
• Cannot change a2a_card_overrides of a flow you do not own.
• Superuser required to administer role assignments.
• Superuser required to administer roles.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/e9fc9a3df4d7077d. Report an issue: GitHub.