langgenius/dify · error · BadRequest

Invalid app id in webapp auth

Error message

Invalid app id in webapp auth

What it means

Raised by _enrich_app_list_items when the system webapp_auth feature is enabled and EnterpriseService.WebAppAuth.batch_get_app_access_mode_by_id returns a result whose length differs from the number of app_ids requested. This is a consistency guard between the App table and the enterprise webapp-auth access-mode store. Surfaces as BadRequest (400).

Source

Thrown at api/controllers/console/app/app.py:523

class AppImportResponse(ResponseModel):
    id: str
    status: ImportStatus
    app_id: str | None = None
    app_mode: str | None = None
    current_dsl_version: str
    imported_dsl_version: str = ""
    error: str = ""
    warnings: list[DslImportWarning] = Field(default_factory=list)


def _enrich_app_list_items(session: Session, *, apps: Sequence[App], tenant_id: str) -> None:
    if FeatureService.get_system_features().webapp_auth.enabled:
        app_ids = [str(app.id) for app in apps]
        res = EnterpriseService.WebAppAuth.batch_get_app_access_mode_by_id(app_ids=app_ids)
        if len(res) != len(app_ids):
            raise BadRequest("Invalid app id in webapp auth")

        for app in apps:
            if str(app.id) in res:
                app.access_mode = res[str(app.id)].access_mode

    workflow_capable_app_ids = [str(app.id) for app in apps if app.mode in {"workflow", "advanced-chat"}]
    draft_trigger_app_ids: set[str] = set()
    if workflow_capable_app_ids:
        draft_workflows = (
            session.execute(
                select(Workflow).where(
                    Workflow.version == Workflow.VERSION_DRAFT,
                    Workflow.app_id.in_(workflow_capable_app_ids),
                    Workflow.tenant_id == tenant_id,
                )
            )
            .scalars()
            .all()

View on GitHub (pinned to ef8544b173)

Solutions

1. Ensure every App row has a corresponding webapp_auth access-mode record (run the enterprise sync/migration).
2. Verify the EnterpriseService.WebAppAuth backend is reachable and consistent with the App table.
3. Retry the list after the enterprise service finishes backfilling access modes.
4. If the issue persists, contact the platform owner to repair the webapp_auth store for the tenant.

try { await axios.get('/apps'); }
catch (e) { if (/Invalid app id in webapp auth/.test(e.message)) { /* surface to admin; retry after sync */ } }

When it happens

Trigger: Listing apps (GET /console/apps) on an instance with webapp_auth enabled, where one or more apps have no corresponding access-mode record in the enterprise store (or stale extras). Also possible if an app is deleted between the App query and the batch_get call.

Common situations: Enterprise webapp_auth feature recently enabled but legacy apps lack access-mode rows; a partial migration of access modes; concurrent app deletion during list; out-of-sync enterprise service after a failed deploy.

Related errors

• Unsupported tag_ids type.
• Invalid UUID format in tag_ids.
• Unsupported creator_ids type.
• Invalid UUID format in creator_ids.
• tracing_provider is required when enabled is True

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/ef542c8ece892ba3. Report an issue: GitHub.