langflow-ai/langflow · error · HTTPException

Flow not found

Error message

Flow not found

What it means

Raised by the share-aware flow route dependency (_get_authorized_flow in authz_route_dependencies.py) when _read_flow returns None, or when ensure_flow_permission denies access in a way converted to 404 via deny_to_404. It is a deliberate UUID-privacy 404: a missing flow and a flow you may not see are indistinguishable. For WRITE/DELETE denial the code first re-checks READ; only if READ is also denied does it collapse to this 404.

Source

Thrown at src/backend/base/langflow/api/v1/authz_route_dependencies.py:30

from langflow.services.authorization import FlowAction, ensure_flow_permission
from langflow.services.authorization.fetch import deny_to_404
from langflow.services.database.models.flow.model import Flow, FlowCreate

_FLOW_WRITE_DENIED_DETAIL = "You don't have permission to edit this flow."
_FLOW_DELETE_DENIED_DETAIL = "You don't have permission to delete this flow."


async def _get_authorized_flow(
    act: FlowAction,
    *,
    flow_id: UUID,
    current_user: CurrentActiveUser,
    session: DbSession,
) -> Flow:
    """Load a flow (share-aware when the plugin supports it) and enforce *act*."""
    flow = await _read_flow(session, flow_id, current_user.id)
    if flow is None:
        raise HTTPException(status_code=404, detail="Flow not found")
    try:
        await ensure_flow_permission(
            current_user,
            act,
            flow_id=flow_id,
            flow_user_id=flow.user_id,
            workspace_id=flow.workspace_id,
            folder_id=flow.folder_id,
        )
    except HTTPException as exc:
        if act in (FlowAction.WRITE, FlowAction.DELETE) and exc.status_code == status.HTTP_403_FORBIDDEN:
            try:
                await ensure_flow_permission(
                    current_user,
                    FlowAction.READ,
                    flow_id=flow_id,
                    flow_user_id=flow.user_id,
                    workspace_id=flow.workspace_id,

View on GitHub (pinned to 976ec789d2)

Solutions

1. Verify the flow id exists in the same environment (owner: GET /api/v1/flows)
2. If accessing another user's flow, create a share grant via POST /api/v1/authz/shares or have the owner share it
3. If running a plugin with cross-user fetch, confirm LANGFLOW_AUTHZ_ENABLED=true and the plugin grants read on flow:{id}
4. Handle 404 idempotently in clients — do not retry, the resource is invisible or gone

async function flowVisible(flowId: string) {
  const res = await fetch(`/api/v1/flows/${flowId}`);
  return res.ok; // 404 => missing or not visible to this caller
}

try {
  return await getAuthorizedFlowForRead(flowId);
} catch (e) {
  if (e.status === 404) return null; // invisible or gone — do not retry
  throw e;
}

When it happens

Trigger: GET/PATCH/DELETE a flow route guarded by get_authorized_flow_for_* with a non-existent flow_id, or with a valid flow_id the caller has no READ grant for (OSS default: any flow owned by another user).

Common situations: Sharing a flow URL with a user who lacks a share grant; stale flow id after the owner deleted it; enabling LANGFLOW_AUTHZ_ENABLED and expecting cross-user reads without a registered plugin (the OSS pass-through reports supports_cross_user_fetch=False, so owner-scoped queries are preserved).

Related errors

• You don't have permission to edit this flow.
• You don't have permission to delete this flow.
• Resource not found
• Share not found
• name cannot be null

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/903947f7948ace3b. Report an issue: GitHub.