Langflow (1.12.0)

List the caller's own A2A-published agent flows, each with its agent-card URL.

Authenticated and owner-scoped, mirroring the MCP-projects catalog: a public cross-user directory would strip the per-flow card's unguessable-id obscurity and expose other users' agents, so this enumerates only the calling user's agents. Each cardUrl is the public discovery entry point an orchestrator fetches per agent.

Serve the spec-valid A2A agent card for an agent-typed, a2a_enabled flow.

Public by design: the A2A public agent card is unauthenticated by spec, so gating it behind login would break standard discovery. Returns 404 when the flag is off, the flow does not exist, the flow is not flow_type=agent, or a2a_enabled is falsy.

Serve the A2A JSON-RPC surface (message/send, message/stream, tasks/get, tasks/resubscribe) for an agent flow.

Gated like the card route; apikey-folder flows additionally require a valid owner key (401). The flow runs as its owner. Returns the SDK's JSON-RPC response (HTTP 200 even for JSON-RPC-level errors). No DbSession dependency here: holding a session open across the run would fight the v2 surface's lock-avoidance design, and the gate/run resolve from flow_id via short self-managed sessions.

Retrieve all component types with compression for better performance.

Returns a compressed response containing all available component types, with display_names translated to the locale indicated by Accept-Language.

Retrieve application configuration settings.

Returns different configuration based on authentication status:

• Authenticated users: Full ConfigResponse with all settings
• Unauthenticated users: PublicConfigResponse with limited, safe-to-expose settings

Args: user: The authenticated user, or None if unauthenticated.

Returns: ConfigResponse | PublicConfigResponse: Configuration settings appropriate for the user's auth status.

Raises: HTTPException: If an error occurs while retrieving the configuration.

Executes a specified flow by ID with optional input values, output selection, tweaks, and streaming capability.

This endpoint supports running flows with caching to enhance performance and efficiency.

Parameters:

• flow (Flow): The flow object to be executed, resolved via dependency injection.
• inputs (List[InputValueRequest], optional): A list of inputs specifying the input values and components for the flow. Each input can target specific components and provide custom values.
• outputs (List[str], optional): A list of output names to retrieve from the executed flow. If not provided, all outputs are returned.
• tweaks (Optional[Tweaks], optional): A dictionary of tweaks to customize the flow execution. The tweaks can be used to modify the flow's parameters and components. Tweaks can be overridden by the input values.
• stream (bool, optional): Specifies whether the results should be streamed. Defaults to False.
• session_id (Union[None, str], optional): An optional session ID to utilize existing session data for the flow execution.
• api_key_user (User): The user associated with the current API key. Automatically resolved from the API key.

Returns:

A RunResponse object containing the selected outputs (or all if not specified) of the executed flow and the session ID. The structure of the response accommodates multiple inputs, providing a nested list of outputs for each input.

Raises:

HTTPException: Indicates issues with finding the specified flow, invalid input formats, or internal errors during flow execution.

Example usage:

POST /run/flow_id
x-api-key: YOUR_API_KEY
Payload:
{
    "inputs": [
        {"components": ["component1"], "input_value": "value1"},
        {"components": ["component3"], "input_value": "value2"}
    ],
    "outputs": ["Component Name", "component_id"],
    "tweaks": {"parameter_name": "value", "Component Name": {"parameter_name": "value"}, "component_id": {"parameter_name": "value"}}
    "stream": false
}

This endpoint facilitates complex flow executions with customized inputs, outputs, and configurations, catering to diverse application requirements.

Executes a specified flow by ID with support for streaming and telemetry (API key auth).

This endpoint executes a flow identified by ID or name, with options for streaming the response and tracking execution metrics. It handles both streaming and non-streaming execution modes. This endpoint uses API key authentication (Bearer token).

Args: background_tasks (BackgroundTasks): FastAPI background task manager flow (FlowRead | None): The flow to execute, loaded via dependency input_request (SimplifiedAPIRequest | None): Input parameters for the flow stream (bool): Whether to stream the response api_key_user (UserRead): Authenticated user from API key context (dict | None): Optional context to pass to the flow http_request (Request): The incoming HTTP request for extracting global variables

Returns: Union[StreamingResponse, RunResponse]: Either a streaming response for real-time results or a RunResponse with the complete execution results

Raises: HTTPException: For flow not found (404) or invalid input (400) APIException: For internal execution errors (500)

Notes: - Supports both streaming and non-streaming execution modes - Tracks execution time and success/failure via telemetry - Handles graceful client disconnection in streaming mode - Provides detailed error handling with appropriate HTTP status codes - Extracts global variables from HTTP headers with prefix X-LANGFLOW-GLOBAL-VAR-* - Merges extracted variables with the context parameter as "request_variables" - In streaming mode, uses EventManager to handle events: - "add_message": New messages during execution - "token": Individual tokens during streaming - "end": Final execution result - Authentication: Requires API key (Bearer token)

Run a flow using a webhook request.

Args: auth: Resolved webhook user and flow, scoped to the authenticated caller. request: The incoming HTTP request.

Returns: A dictionary containing the status of the task.

Raises: HTTPException: If the flow is not found or if there is an error processing the request.

Build and process a flow, returning a job ID for event polling.

This endpoint requires authentication through the CurrentActiveUser dependency. For public flows that don't require authentication, use the /build_public_tmp/flow_id/flow endpoint.

Args: flow_id: UUID of the flow to build background_tasks: Background tasks manager inputs: Optional input values for the flow data: Optional flow data files: Optional files to include stop_component_id: Optional ID of component to stop at start_component_id: Optional ID of component to start from log_builds: Whether to log the build process current_user: The authenticated user queue_service: Queue service for job management flow_name: Optional name for the flow event_delivery: Optional event delivery type - default is streaming

Returns: Dict with job_id that can be used to poll for build status

Cancel a specific build job.

Requires authentication and ownership verification to prevent a user from aborting another user's running build (DoS via job cancellation). Jobs with no registered owner (build_public_tmp) are accessible to any authenticated user, consistent with get_build_events.

Get events for a specific build job.

Requires authentication and ownership verification. A job owner is registered when build_flow is called; if a registered owner does not match the requesting user the endpoint returns 404 to avoid leaking job existence. Jobs started via build_public_tmp have no registered owner and remain accessible to any authenticated user.

Build a public flow without requiring authentication.

This endpoint is specifically for public flows that don't require authentication. It uses a client_id cookie to create a deterministic flow ID for tracking purposes.

Security Note:

• The 'data' parameter is NOT accepted to prevent flow definition tampering
• Public flows must execute the stored flow definition only
• The flow definition is always loaded from the database
• Caller-supplied 'inputs.session' is namespaced under the (client_id, flow_id) virtual flow ID so an unauthenticated caller cannot address a session that lives outside its own namespace (CVE-2026-33017)

The endpoint:

1. Verifies the requested flow is marked as public in the database
2. Creates a deterministic UUID based on client_id and flow_id
3. Uses a stable anonymous principal to build the flow
4. Always loads the flow definition from the database

Requirements:

• The flow must be marked as PUBLIC in the database
• The request must include a client_id cookie

Args: flow_id: UUID of the public flow to build background_tasks: Background tasks manager inputs: Optional input values for the flow files: Optional files to include stop_component_id: Optional ID of component to stop at start_component_id: Optional ID of component to start from log_builds: Whether to log the build process flow_name: Optional name for the flow request: FastAPI request object (needed for cookie access) queue_service: Queue service for job management authenticated_user: Optional authenticated user (resolved from cookie/token if present) event_delivery: Optional event delivery type - default is streaming

Returns: Dict with job_id that can be used to poll for build status

Cancel a public flow build job.

This endpoint does not require authentication, matching the public build endpoint. It is used by the shareable playground to cancel builds.

Get events for a public flow build job.

This endpoint does not require authentication, matching the public build endpoint. It is used by the shareable playground to consume build events.

Return the complete global component block set.

Replace the complete global component block set.

Return the complete global template block set.

Replace the complete global template block set.

Return how many flows use each component.

Counts are keyed by canonical registry identity — a flow node saved under a legacy alias is counted under the component it resolves to today, the same resolution catalog enforcement applies. Keys not present in the registry (custom or synthetic components) are counted under their exact stored key. Each flow is counted at most once per component. Counts may lag flow writes by up to USAGE_SCAN_CACHE_TTL_SECONDS.

Return the flows that would be affected by blocking one component key.

A flow matches when the queried key and any of the flow's stored keys resolve to a shared canonical identity — the same matching rule flow writes and runs enforce. Flows are sorted by name, then id, and truncated to limit; total always reports the full match count. Results may lag flow writes by up to USAGE_SCAN_CACHE_TTL_SECONDS.

Poll for extension lifecycle events the current user has triggered.

Events are scoped to the authenticated user via a server-derived keyspace (user:{user_id}); there is no client-controllable keyspace, so an authenticated user cannot read another user's flow-migration or bundle-reload events. A client-supplied keyspace query parameter is rejected with 422 so the contract is explicit -- previously the value was silently dropped, which masked client bugs that assumed it had effect.

svc.since() uses blocking sqlite3; run in a thread pool so the asyncio event loop is not held while waiting on disk I/O.

Trigger an atomic-swap reload for a single Bundle.

Returns the typed :class:~lfx.extension.reload.ReloadResult body on success. Per the typed-error contract, structural failures (broken bundle, missing source path, name mismatch) surface as 422 Unprocessable Entity with the first typed error in the body so clients can surface fix hints inline; the full ReloadResult payload (with all errors and warnings) is returned via the FastAPI detail envelope. Concurrency-control collisions surface as 409 Conflict (reload-in-progress). Non-2xx is the wire contract for every error path -- the body still carries the typed error so the client renders the same fix-hint envelope.

Download image from storage for browser rendering.

List profile pictures from local filesystem.

Profile pictures are first looked up in config_dir/profile_pictures/, then fallback to the package's bundled profile_pictures directory.

Download profile picture from local filesystem.

Profile pictures are first looked up in config_dir/profile_pictures/, then fallback to the package's bundled profile_pictures directory.

Delete all files for the current user.

List the files available to the current user.

Upload a file for the current user and track it in the database.

Delete all files for the current user.

List the files available to the current user.

Upload a file for the current user and track it in the database.

Delete multiple files by their IDs.

Download multiple files as a zip file by their IDs.

Delete a file by its ID.

Download a file by its ID or return its content as a string/bytes.

Args: file_id: UUID of the file. current_user: Authenticated user. session: Database session. storage_service: File storage service. return_content: If True, return raw content (str) instead of StreamingResponse.

Returns: StreamingResponse for client downloads or str for internal use.

Edit the name of a file by its ID.

Delete multiple flows by their IDs.

Retrieve a list of flows with optional pagination, filtering, and header-only mode.

Retrieve a list of basic example flows.

Create multiple new flows.