langflow-ai/langflow · error · HTTPException

Superuser required to administer teams.

Error message

Superuser required to administer teams.

What it means

Raised by every route on /api/v1/authz/teams via _require_superuser when the authenticated user has is_superuser=False. The entire team administration API (list/create/update/delete teams and members) is superuser-only in OSS Langflow; there is no per-team admin grant.

Source

Thrown at src/backend/base/langflow/api/v1/authz_teams.py:46

from langflow.services.authorization.invalidation import (
    safe_invalidate_all,
    safe_invalidate_user,
)
from langflow.services.authorization.utils import audit_decision
from langflow.services.database.models.auth import AuthzTeam, AuthzTeamMember
from langflow.services.database.models.user.model import User
from langflow.services.deps import get_authorization_service

router = APIRouter(prefix="/authz/teams", tags=["Authorization"])

# See ``authz_roles._LIST_MAX_LIMIT`` — same bound, applied to teams + members.
_LIST_MAX_LIMIT = 200
_LIST_DEFAULT_LIMIT = 100


def _require_superuser(user) -> None:
    if not getattr(user, "is_superuser", False):
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Superuser required to administer teams.",
        )


# --- teams ---------------------------------------------------------------- #


@router.get("", response_model=list[TeamRead])
@router.get("/", response_model=list[TeamRead])
async def list_teams(
    session: DbSession,
    current_user: CurrentActiveUser,  # noqa: ARG001 — any authenticated user can list
    search: Annotated[str | None, Query(description="Substring match on team_name or adom_name")] = None,
    is_active: Annotated[bool | None, Query()] = None,
    limit: Annotated[int, Query(ge=1, le=_LIST_MAX_LIMIT)] = _LIST_DEFAULT_LIMIT,
    offset: Annotated[int, Query(ge=0)] = 0,
) -> list[TeamRead]:

View on GitHub (pinned to 976ec789d2)

Solutions

1. Authenticate as a user with is_superuser=true (the Langflow superuser/admin account)
2. If using a service account for team provisioning, ensure it is flagged superuser in the DB
3. Hide team-management UI for non-superusers to avoid the 403 entirely

async function requireSuperuser() {
  const me = await getCurrentUser();
  if (!me.is_superuser) throw new Error('teams API requires a superuser account');
  return me;
}

const isSuperuser = (u: {is_superuser?: boolean} | null): boolean =>
  !!u?.is_superuser;

When it happens

Trigger: Any call to /api/v1/authz/teams* (GET, POST, PATCH, DELETE, member operations) as a regular non-superuser account.

Common situations: Logging in as a normal user and pointing admin UI at the teams endpoints; service accounts not flagged superuser; assuming workspace/project admin rights grant team administration (they do not).

Related errors

• You don't have permission to edit this flow.
• You don't have permission to delete this flow.
• Only the resource owner or a superuser may administer shares
• Superuser required to administer role assignments.
• user_id not found

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/caa4fead8c5fb33d. Report an issue: GitHub.