Langflow (1.11.0)

List the caller's own A2A-published agent flows, each with its agent-card URL.

Authenticated and owner-scoped, mirroring the MCP-projects catalog: a public cross-user directory would strip the per-flow card's unguessable-id obscurity and expose other users' agents, so this enumerates only the calling user's agents. Each cardUrl is the public discovery entry point an orchestrator fetches per agent.

Serve the spec-valid A2A agent card for an agent-typed, a2a_enabled flow.

Public by design: the A2A public agent card is unauthenticated by spec, so gating it behind login would break standard discovery. Returns 404 when the flag is off, the flow does not exist, the flow is not flow_type=agent, or a2a_enabled is falsy.

Serve the A2A JSON-RPC surface (message/send, message/stream, tasks/get, tasks/resubscribe) for an agent flow.

Gated like the card route; apikey-folder flows additionally require a valid owner key (401). The flow runs as its owner. Returns the SDK's JSON-RPC response (HTTP 200 even for JSON-RPC-level errors). No DbSession dependency here: holding a session open across the run would fight the v2 surface's lock-avoidance design, and the gate/run resolve from flow_id via short self-managed sessions.

Chat with the Langflow Assistant.

Chat with the Langflow Assistant with streaming progress updates.

Check if the Langflow Assistant is properly configured.

Returns available providers with their configured status and available models.

Execute a named flow from the flows directory.

Named assistant flows embed an Agent that needs provider/model/api-key context. Resolving it here (instead of running the raw file) turns a silent 500 into a successful run, or a clear 4xx when no provider is set.

Return the contents of a sandboxed file as text (or as an attachment).

Raises: HTTPException(400): The path shape is invalid (traversal, absolute, null byte, etc.). No I/O is attempted. HTTPException(404): The file does not exist in the requesting user's sandbox. Same status for sandbox-internal "not found" and for "path resolves outside the user namespace" — by design, to avoid leaking namespace existence to another tenant. HTTPException(413): The file is larger than MAX_FILE_SIZE_BYTES. HTTPException(415): The file is binary (null byte in the first 8 KiB).

Drop the calling user's session-scoped state.

Wipes: - conversation buffer for session_id (if provided). - registered components under the user's FS sandbox.

The user id is sourced from the authenticated session — the session_id query parameter only addresses the conversation buffer entry and is never trusted for path resolution.

Returns a small envelope describing what was cleared, sufficient for ops/log correlation but stripped of anything sensitive:

{"status": "ok", "components_cleared": <int>, "session_id": <str|null>}

Retrieve all component types with compression for better performance.

Returns a compressed response containing all available component types, with display_names translated to the locale indicated by Accept-Language.

Retrieve application configuration settings.

Returns different configuration based on authentication status:

• Authenticated users: Full ConfigResponse with all settings
• Unauthenticated users: PublicConfigResponse with limited, safe-to-expose settings

Args: user: The authenticated user, or None if unauthenticated.

Returns: ConfigResponse | PublicConfigResponse: Configuration settings appropriate for the user's auth status.

Raises: HTTPException: If an error occurs while retrieving the configuration.

Executes a specified flow by ID with optional input values, output selection, tweaks, and streaming capability.

This endpoint supports running flows with caching to enhance performance and efficiency.

Parameters:

• flow (Flow): The flow object to be executed, resolved via dependency injection.
• inputs (List[InputValueRequest], optional): A list of inputs specifying the input values and components for the flow. Each input can target specific components and provide custom values.
• outputs (List[str], optional): A list of output names to retrieve from the executed flow. If not provided, all outputs are returned.
• tweaks (Optional[Tweaks], optional): A dictionary of tweaks to customize the flow execution. The tweaks can be used to modify the flow's parameters and components. Tweaks can be overridden by the input values.
• stream (bool, optional): Specifies whether the results should be streamed. Defaults to False.
• session_id (Union[None, str], optional): An optional session ID to utilize existing session data for the flow execution.
• api_key_user (User): The user associated with the current API key. Automatically resolved from the API key.

Returns:

A RunResponse object containing the selected outputs (or all if not specified) of the executed flow and the session ID. The structure of the response accommodates multiple inputs, providing a nested list of outputs for each input.

Raises:

HTTPException: Indicates issues with finding the specified flow, invalid input formats, or internal errors during flow execution.

Example usage:

POST /run/flow_id
x-api-key: YOUR_API_KEY
Payload:
{
    "inputs": [
        {"components": ["component1"], "input_value": "value1"},
        {"components": ["component3"], "input_value": "value2"}
    ],
    "outputs": ["Component Name", "component_id"],
    "tweaks": {"parameter_name": "value", "Component Name": {"parameter_name": "value"}, "component_id": {"parameter_name": "value"}}
    "stream": false
}

This endpoint facilitates complex flow executions with customized inputs, outputs, and configurations, catering to diverse application requirements.

Executes a specified flow by ID with support for streaming and telemetry (API key auth).

This endpoint executes a flow identified by ID or name, with options for streaming the response and tracking execution metrics. It handles both streaming and non-streaming execution modes. This endpoint uses API key authentication (Bearer token).

Args: background_tasks (BackgroundTasks): FastAPI background task manager flow (FlowRead | None): The flow to execute, loaded via dependency input_request (SimplifiedAPIRequest | None): Input parameters for the flow stream (bool): Whether to stream the response api_key_user (UserRead): Authenticated user from API key context (dict | None): Optional context to pass to the flow http_request (Request): The incoming HTTP request for extracting global variables

Returns: Union[StreamingResponse, RunResponse]: Either a streaming response for real-time results or a RunResponse with the complete execution results

Raises: HTTPException: For flow not found (404) or invalid input (400) APIException: For internal execution errors (500)

Notes: - Supports both streaming and non-streaming execution modes - Tracks execution time and success/failure via telemetry - Handles graceful client disconnection in streaming mode - Provides detailed error handling with appropriate HTTP status codes - Extracts global variables from HTTP headers with prefix X-LANGFLOW-GLOBAL-VAR-* - Merges extracted variables with the context parameter as "request_variables" - In streaming mode, uses EventManager to handle events: - "add_message": New messages during execution - "token": Individual tokens during streaming - "end": Final execution result - Authentication: Requires API key (Bearer token)

Run a flow using a webhook request.

Args: auth: Resolved webhook user and flow, scoped to the authenticated caller. request: The incoming HTTP request.

Returns: A dictionary containing the status of the task.

Raises: HTTPException: If the flow is not found or if there is an error processing the request.

Return a paginated slice of the audit log filtered by the given query params.

Superuser only. The composite indexes on (user_id, timestamp) and (resource_type, resource_id) keep both "show me events for user X" and "show me events on resource Y" fast at scale.

Return a paginated slice of the audit log filtered by the given query params.

Superuser only. The composite indexes on (user_id, timestamp) and (resource_type, resource_id) keep both "show me events for user X" and "show me events on resource Y" fast at scale.

Return per-resource allowed actions for the current user.

Use this to render the UI permission gate (greyed-out buttons etc.) without flooding the audit log with denied probes. Empty list for a resource_id means the user cannot perform any of the requested actions on that resource.

List role assignments scoped to one user.

• Omitting user_id defaults to the caller — no superuser needed.
• Passing user_id == self.id is the same as omitting it.
• Passing a different user_id requires superuser; otherwise 403.

Results are always filtered by the resolved user_id. Admins who need cross-user lookups make one call per user. Paginated via limit / offset (default 100, max 200).

Assign a role to a user. Superuser-only.

List role assignments scoped to one user.

• Omitting user_id defaults to the caller — no superuser needed.
• Passing user_id == self.id is the same as omitting it.
• Passing a different user_id requires superuser; otherwise 403.

Results are always filtered by the resolved user_id. Admins who need cross-user lookups make one call per user. Paginated via limit / offset (default 100, max 200).

Assign a role to a user. Superuser-only.

Revoke a role assignment. Superuser-only.

List roles. Open to authenticated users so the UI can populate dropdowns.

Paginated via limit / offset so a single call cannot return the entire catalog of roles + their permissions. Stable order is (name, id) so offset is deterministic across calls.

Create a custom (non-system) role. Superuser-only.

List roles. Open to authenticated users so the UI can populate dropdowns.

Paginated via limit / offset so a single call cannot return the entire catalog of roles + their permissions. Stable order is (name, id) so offset is deterministic across calls.

Create a custom (non-system) role. Superuser-only.

Delete a custom role.

System roles cannot be deleted; roles with active assignments return 409 (delete the assignments first).

Update fields on a custom role. System roles are read-only.

List share rows visible to the caller (paginated, max 200).

Create an authz_share row for a resource.

List share rows visible to the caller (paginated, max 200).

Create an authz_share row for a resource.

Revoke an existing share.

Fetch a single share by id with the same visibility rules as list.

Update the permission level of an existing share.