langflow-ai/langflow · error · HTTPException

Resource not found

Error message

Resource not found

What it means

Raised by POST /api/v1/authz/shares when _resolve_resource_owner cannot find the target resource (flow/knowledge base/etc. named by resource_type + resource_id) — the owner lookup returns None and the route returns 404 to avoid leaking whether the resource exists (UUID privacy).

Source

Thrown at src/backend/base/langflow/api/v1/authz_shares.py:217

    )


@router.post("", response_model=ShareRead, status_code=status.HTTP_201_CREATED)
@router.post("/", response_model=ShareRead, status_code=status.HTTP_201_CREATED)
async def create_share(
    payload: ShareCreate,
    current_user: CurrentActiveUser,
    session: DbSession,
) -> ShareRead:
    """Create an authz_share row for a resource."""
    owner_id = await _resolve_resource_owner(
        session,
        resource_type=payload.resource_type,
        resource_id=payload.resource_id,
    )
    if owner_id is None:
        # UUID privacy: missing resource → 404.
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Resource not found")
    await _ensure_can_administer_share(user=current_user, owner_id=owner_id)
    # SECURITY: pass the *resource* owner (not the caller) so the owner-override
    # in ensure_share_permission only fast-paths the real resource owner. With
    # share_user_id=current_user.id the override would always trip and the
    # authorization plugin's enforce() would never run for non-owner creators
    # when the OSS floor is bypassed (cross_user_fetch + AUTHZ_ENABLED).
    await ensure_share_permission(
        current_user,
        ShareAction.CREATE,
        share_user_id=owner_id,
    )

    row = AuthzShare(
        resource_type=payload.resource_type,
        resource_id=payload.resource_id,
        scope=payload.scope,
        target_id=payload.target_id,
        permission_level=payload.permission_level,

View on GitHub (pinned to 976ec789d2)

Solutions

1. Verify the resource exists first (e.g. GET /api/v1/flows/{id}) and use the id from that response
2. Check resource_type matches the actual resource kind in your payload
3. If the resource was deleted, abandon the share creation — nothing to share

async function resourceExists(resourceType: string, resourceId: string) {
  const res = await fetch(`/api/v1/${resourceType}s/${resourceId}`);
  return res.ok;
}

const isUuid = (s: string): boolean =>
  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s);

When it happens

Trigger: POST /authz/shares with a resource_id that does not exist for the given resource_type; wrong resource_type for the id; resource deleted between fetching its id and creating the share.

Common situations: Sharing a flow id copied from another environment; typo in the UUID; sharing a resource that was just deleted; passing a deployment id with resource_type='flow'.

Related errors

• Unknown scope {scope!r}
• Share not found
• Unknown permission_level {payload.permission_level!r}
• name cannot be null
• permissions cannot be null; pass an empty list to clear

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/4ddf836296f03f75. Report an issue: GitHub.