langflow-ai/langflow · error · HTTPException

Cannot transfer ownership of a flow you do not own.

Error message

Cannot transfer ownership of a flow you do not own.

What it means

HTTP 403 from _update_flow: a non-owner edit supplies a user_id different from the flow's owner — an attempted ownership transfer. Ownership transfer is owner-only; the create path likewise ignores body user_id, so this guard closes the update-side hole.

Source

Thrown at src/backend/base/langflow/api/v1/flows_helpers.py:425

    owner_user_id: UUID = existing_flow.user_id
    is_owner_edit = owner_user_id == actor_user_id

    # Non-owner edits cannot relocate the flow into folders or storage they
    # own, nor transfer ownership. Reject early so the failure is explicit
    # rather than corrupting scope downstream.
    if not is_owner_edit:
        if flow.folder_id is not None and flow.folder_id != existing_flow.folder_id:
            raise HTTPException(
                status_code=403,
                detail="Cannot change folder of a flow you do not own.",
            )
        if flow.fs_path is not None and flow.fs_path != existing_flow.fs_path:
            raise HTTPException(
                status_code=403,
                detail="Cannot change fs_path of a flow you do not own.",
            )
        if flow.user_id is not None and flow.user_id != owner_user_id:
            raise HTTPException(
                status_code=403,
                detail="Cannot transfer ownership of a flow you do not own.",
            )
        # ``a2a_enabled`` defaults to False (not None) on FlowCreate, so gate on
        # model_fields_set to block only an explicit, differing change.
        if "a2a_enabled" in flow.model_fields_set and flow.a2a_enabled != existing_flow.a2a_enabled:
            raise HTTPException(
                status_code=403,
                detail="Cannot change a2a_enabled of a flow you do not own.",
            )
        if (
            "a2a_card_overrides" in flow.model_fields_set
            and flow.a2a_card_overrides != existing_flow.a2a_card_overrides
        ):
            raise HTTPException(
                status_code=403,
                detail="Cannot change a2a_card_overrides of a flow you do not own.",
            )

View on GitHub (pinned to 976ec789d2)

Solutions

1. Omit user_id from update payloads entirely.
2. For genuine ownership transfer, use an admin/superuser transfer mechanism or export+import under the new owner.
3. Strip echo-back fields (user_id, id) in client update payloads.

Example fix

# before
{"name": "f", "user_id": "<new-owner-uuid>"}
# after
{"name": "f"}

delete body.user_id; // never send user_id on update

When it happens

Trigger: PATCH/PUT by a non-owner with {"user_id": "<their-own-or-third uuid>"} in the body.

Common situations: Admin tooling tries to reassign flows between users via the normal update endpoint; clients echo the full flow representation back including user_id; org restructures where someone attempts bulk reassignment without owner credentials.

Related errors

• Flow is not public
• Cannot change folder of a flow you do not own.
• Cannot change fs_path of a flow you do not own.
• Cannot change a2a_enabled of a flow you do not own.
• Cannot change a2a_card_overrides of a flow you do not own.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/b3902d8cc5e9d9fd. Report an issue: GitHub.