langflow-ai/langflow · error · HTTPException

You don't have permission to edit this flow.

Error message

You don't have permission to edit this flow.

What it means

Raised by _get_authorized_flow when the caller requests FlowAction.WRITE but ensure_flow_permission denies it, AND a follow-up READ check succeeds (i.e. you can see the flow but not modify it). In that case the route returns an honest 403 with this message instead of hiding the flow as a 404. Requires superuser/owner-style write access being absent while read access exists (e.g. a viewer-level share or plugin grant).

Source

Thrown at src/backend/base/langflow/api/v1/authz_route_dependencies.py:54

            flow_user_id=flow.user_id,
            workspace_id=flow.workspace_id,
            folder_id=flow.folder_id,
        )
    except HTTPException as exc:
        if act in (FlowAction.WRITE, FlowAction.DELETE) and exc.status_code == status.HTTP_403_FORBIDDEN:
            try:
                await ensure_flow_permission(
                    current_user,
                    FlowAction.READ,
                    flow_id=flow_id,
                    flow_user_id=flow.user_id,
                    workspace_id=flow.workspace_id,
                    folder_id=flow.folder_id,
                )
            except HTTPException as read_exc:
                raise deny_to_404(read_exc, detail="Flow not found") from read_exc
            denied_detail = _FLOW_WRITE_DENIED_DETAIL if act == FlowAction.WRITE else _FLOW_DELETE_DENIED_DETAIL
            raise HTTPException(status_code=403, detail=denied_detail) from exc
        raise deny_to_404(exc, detail="Flow not found") from exc
    return flow


async def get_authorized_flow_for_read(
    flow_id: UUID,
    current_user: CurrentActiveUser,
    session: DbSession,
) -> Flow:
    """Return a flow the caller may read (404 when denied or missing)."""
    return await _get_authorized_flow(FlowAction.READ, flow_id=flow_id, current_user=current_user, session=session)


async def get_authorized_flow_for_write(
    flow_id: UUID,
    current_user: CurrentActiveUser,
    session: DbSession,
) -> Flow:

View on GitHub (pinned to 976ec789d2)

Solutions

1. Ask the owner to grant write (e.g. a share with a write-capable permission_level, or a plugin role with flow:write)
2. Check your effective grants before editing (plugin audit/share listing) and disable edit UI when only read is held
3. Fork/copy the flow into your own workspace if edit rights cannot be granted

try {
  await saveFlow(flowId, data);
} catch (e) {
  if (e.status === 403 && e.detail.includes('edit')) {
    showToast('Read-only access — ask the owner for write permission');
    setReadOnlyMode(true);
  } else throw e;
}

When it happens

Trigger: PATCH/PUT a flow when the caller holds only a read-level share or a plugin grant of read but not write on flow:{id} or its project/workspace domain.

Common situations: Collaborator given viewer permission trying to edit; plugin role mapped to read-only on the project domain; assuming share visibility implies edit rights.

Related errors

• You don't have permission to delete this flow.
• Superuser required to administer teams.
• Flow not found
• Only the resource owner or a superuser may administer shares
• Superuser required to administer role assignments.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/34b0788505838d9d. Report an issue: GitHub.