langflow-ai/langflow · warning · HTTPException

Unknown scope {scope!r}

Error message

Unknown scope {scope!r}

What it means

Raised by GET /api/v1/authz/shares when the optional scope query parameter is not a valid ShareScope enum value. The route converts the raw string with ShareScope(scope) and a ValueError becomes a 400 with the offending value echoed back. (The inline comment says 422, but the code returns 400.)

Source

Thrown at src/backend/base/langflow/api/v1/authz_shares.py:308

    await ensure_share_permission(
        current_user,
        ShareAction.READ,
        share_user_id=current_user.id,
    )

    stmt = select(AuthzShare)
    if resource_type is not None:
        stmt = stmt.where(AuthzShare.resource_type == resource_type)
    if resource_id is not None:
        stmt = stmt.where(AuthzShare.resource_id == resource_id)
    if target_id is not None:
        stmt = stmt.where(AuthzShare.target_id == target_id)
    if scope is not None:
        # Reject unknown scope values early (422).
        try:
            scope_value = ShareScope(scope).value
        except ValueError as exc:
            raise HTTPException(status_code=400, detail=f"Unknown scope {scope!r}") from exc
        stmt = stmt.where(AuthzShare.scope == scope_value)

    # Stable ordering with offset/limit pagination.
    stmt = stmt.order_by(AuthzShare.created_at.desc(), AuthzShare.id).offset(offset).limit(limit)

    rows = list(await session.exec(stmt))

    is_superuser = getattr(current_user, "is_superuser", False)
    if is_superuser:
        return await _serialize_shares(session, rows)

    # Pre-fetch team memberships (avoid N+1 per row).
    team_membership_stmt = select(AuthzTeamMember.team_id).where(AuthzTeamMember.user_id == current_user.id)
    caller_team_ids: set[UUID] = set(await session.exec(team_membership_stmt))

    # Filter rows by visibility rules for non-superusers.
    visible: list[AuthzShare] = []
    owner_cache: dict[tuple[str, UUID], UUID | None] = {}

View on GitHub (pinned to 976ec789d2)

Solutions

1. Use only the scope values advertised by the API's OpenAPI schema for ShareScope
2. Drop the scope parameter entirely if you meant 'all scopes'
3. Fetch and validate the enum members from /openapi.json at client build time

Example fix

// before
GET /api/v1/authz/shares?scope=organisation

// after
GET /api/v1/authz/shares?scope=organization

const SHARE_SCOPES = ['user', 'team']; // mirror ShareScope enum from /openapi.json
if (scope !== undefined && !SHARE_SCOPES.includes(scope)) {
  throw new Error(`invalid scope ${scope}`);
}

const isShareScope = (s: string): boolean => ['user', 'team'].includes(s);

When it happens

Trigger: GET /authz/shares?scope=organisation (misspelled), ?scope=global when the enum only defines e.g. user/team, or any string outside the ShareScope members.

Common situations: Hardcoded scope strings drifting from the enum after an upgrade; URL-encoding issues producing unexpected query values; copy-pasting scope values from older API docs.

Related errors

• Unknown permission_level {payload.permission_level!r}
• Resource not found
• name cannot be null
• permissions cannot be null; pass an empty list to clear
• Only the resource owner or a superuser may administer shares

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/f2a681f37fc36f33. Report an issue: GitHub.