langflow-ai/langflow · error · HTTPException

You don't have permission to delete this flow.

Error message

You don't have permission to delete this flow.

What it means

Raised by _get_authorized_flow when the caller requests FlowAction.DELETE but ensure_flow_permission denies it, while a follow-up READ check succeeds — you can see the flow but not delete it. The route returns 403 with this message; if READ were also denied it would collapse to 404 instead.

Source

Thrown at src/backend/base/langflow/api/v1/authz_route_dependencies.py:54

            flow_user_id=flow.user_id,
            workspace_id=flow.workspace_id,
            folder_id=flow.folder_id,
        )
    except HTTPException as exc:
        if act in (FlowAction.WRITE, FlowAction.DELETE) and exc.status_code == status.HTTP_403_FORBIDDEN:
            try:
                await ensure_flow_permission(
                    current_user,
                    FlowAction.READ,
                    flow_id=flow_id,
                    flow_user_id=flow.user_id,
                    workspace_id=flow.workspace_id,
                    folder_id=flow.folder_id,
                )
            except HTTPException as read_exc:
                raise deny_to_404(read_exc, detail="Flow not found") from read_exc
            denied_detail = _FLOW_WRITE_DENIED_DETAIL if act == FlowAction.WRITE else _FLOW_DELETE_DENIED_DETAIL
            raise HTTPException(status_code=403, detail=denied_detail) from exc
        raise deny_to_404(exc, detail="Flow not found") from exc
    return flow


async def get_authorized_flow_for_read(
    flow_id: UUID,
    current_user: CurrentActiveUser,
    session: DbSession,
) -> Flow:
    """Return a flow the caller may read (404 when denied or missing)."""
    return await _get_authorized_flow(FlowAction.READ, flow_id=flow_id, current_user=current_user, session=session)


async def get_authorized_flow_for_write(
    flow_id: UUID,
    current_user: CurrentActiveUser,
    session: DbSession,
) -> Flow:

View on GitHub (pinned to 976ec789d2)

Solutions

1. Have the resource owner (or a superuser) perform the delete
2. Request a delete-capable grant from the authorization plugin administrator
3. In shared workflows, ask the owner to remove you from the share instead of deleting the flow yourself

try {
  await deleteFlow(flowId);
} catch (e) {
  if (e.status === 403 && e.detail.includes('delete')) {
    confirm('Only the owner can delete this flow — request deletion from the owner.');
  } else throw e;
}

When it happens

Trigger: DELETE /api/v1/flows/{id} when the caller holds read but not delete permission (non-owner without a delete grant, or a plugin denying delete on flow:{id}).

Common situations: Editor-level collaborators trying to delete the owner's flow; plugin granting write but not delete; assuming write implies delete.

Related errors

• You don't have permission to edit this flow.
• Superuser required to administer teams.
• System roles cannot be deleted
• Role still has active assignments — revoke them before delet
• Flow not found

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/b797dd6dfc6943e6. Report an issue: GitHub.