Langflow (1.10.0)

Chat with the Langflow Assistant.

Chat with the Langflow Assistant with streaming progress updates.

Check if the Langflow Assistant is properly configured.

Returns available providers with their configured status and available models.

Execute a named flow from the flows directory.

Named assistant flows embed an Agent that needs provider/model/api-key
context. Resolving it here (instead of running the raw file) turns a
silent 500 into a successful run, or a clear 4xx when no provider is set.

Return the contents of a sandboxed file as text (or as an attachment).

Raises:
HTTPException(400): The path shape is invalid (traversal, absolute,
null byte, etc.). No I/O is attempted.
HTTPException(404): The file does not exist in the requesting user's
sandbox. Same status for sandbox-internal "not found" and for
"path resolves outside the user namespace" — by design, to avoid
leaking namespace existence to another tenant.
HTTPException(413): The file is larger than MAX_FILE_SIZE_BYTES.
HTTPException(415): The file is binary (null byte in the first 8 KiB).

Drop the calling user's session-scoped state.

Wipes:
- conversation buffer for session_id (if provided).
- registered components under the user's FS sandbox.

The user id is sourced from the authenticated session — the
session_id query parameter only addresses the conversation
buffer entry and is never trusted for path resolution.

Returns a small envelope describing what was cleared, sufficient
for ops/log correlation but stripped of anything sensitive:

<br>{"status": "ok", "components_cleared": <int>, "session_id": <str|null>}<br>

Retrieve all component types with compression for better performance.

Returns a compressed response containing all available component types,
with display_names translated to the locale indicated by Accept-Language.

Retrieve application configuration settings.

Returns different configuration based on authentication status:
- Authenticated users: Full ConfigResponse with all settings
- Unauthenticated users: PublicConfigResponse with limited, safe-to-expose settings

Args:
user: The authenticated user, or None if unauthenticated.

Returns:
ConfigResponse | PublicConfigResponse: Configuration settings appropriate for the user's auth status.

Raises:
HTTPException: If an error occurs while retrieving the configuration.

Executes a specified flow by ID with optional input values, output selection, tweaks, and streaming capability.

This endpoint supports running flows with caching to enhance performance and efficiency.

### Parameters:
- flow (Flow): The flow object to be executed, resolved via dependency injection.
- inputs (List[InputValueRequest], optional): A list of inputs specifying the input values and components
for the flow. Each input can target specific components and provide custom values.
- outputs (List[str], optional): A list of output names to retrieve from the executed flow.
If not provided, all outputs are returned.
- tweaks (Optional[Tweaks], optional): A dictionary of tweaks to customize the flow execution.
The tweaks can be used to modify the flow's parameters and components.
Tweaks can be overridden by the input values.
- stream (bool, optional): Specifies whether the results should be streamed. Defaults to False.
- session_id (Union[None, str], optional): An optional session ID to utilize existing session data for the flow
execution.
- api_key_user (User): The user associated with the current API key. Automatically resolved from the API key.

### Returns:
A RunResponse object containing the selected outputs (or all if not specified) of the executed flow
and the session ID.
The structure of the response accommodates multiple inputs, providing a nested list of outputs for each input.

### Raises:
HTTPException: Indicates issues with finding the specified flow, invalid input formats, or internal errors during
flow execution.

### Example usage:
json<br>POST /run/flow_id<br>x-api-key: YOUR_API_KEY<br>Payload:<br>{<br> "inputs": [<br> {"components": ["component1"], "input_value": "value1"},<br> {"components": ["component3"], "input_value": "value2"}<br> ],<br> "outputs": ["Component Name", "component_id"],<br> "tweaks": {"parameter_name": "value", "Component Name": {"parameter_name": "value"}, "component_id": {"parameter_name": "value"}}<br> "stream": false<br>}<br>

This endpoint facilitates complex flow executions with customized inputs, outputs, and configurations,
catering to diverse application requirements.

Executes a specified flow by ID with support for streaming and telemetry (API key auth).

This endpoint executes a flow identified by ID or name, with options for streaming the response
and tracking execution metrics. It handles both streaming and non-streaming execution modes.
This endpoint uses API key authentication (Bearer token).

Args:
background_tasks (BackgroundTasks): FastAPI background task manager
flow (FlowRead | None): The flow to execute, loaded via dependency
input_request (SimplifiedAPIRequest | None): Input parameters for the flow
stream (bool): Whether to stream the response
api_key_user (UserRead): Authenticated user from API key
context (dict | None): Optional context to pass to the flow
http_request (Request): The incoming HTTP request for extracting global variables

Returns:
Union[StreamingResponse, RunResponse]: Either a streaming response for real-time results
or a RunResponse with the complete execution results

Raises:
HTTPException: For flow not found (404) or invalid input (400)
APIException: For internal execution errors (500)

Notes:
- Supports both streaming and non-streaming execution modes
- Tracks execution time and success/failure via telemetry
- Handles graceful client disconnection in streaming mode
- Provides detailed error handling with appropriate HTTP status codes
- Extracts global variables from HTTP headers with prefix X-LANGFLOW-GLOBAL-VAR-*
- Merges extracted variables with the context parameter as "request_variables"
- In streaming mode, uses EventManager to handle events:
- "add_message": New messages during execution
- "token": Individual tokens during streaming
- "end": Final execution result
- Authentication: Requires API key (Bearer token)

Run a flow using a webhook request.

Args:
auth: Resolved webhook user and flow, scoped to the authenticated caller.
request: The incoming HTTP request.

Returns:
A dictionary containing the status of the task.

Raises:
HTTPException: If the flow is not found or if there is an error processing the request.

Return a paginated slice of the audit log filtered by the given query params.

Superuser only. The composite indexes on (user_id, timestamp) and
(resource_type, resource_id) keep both "show me events for user X"
and "show me events on resource Y" fast at scale.

Return a paginated slice of the audit log filtered by the given query params.

Superuser only. The composite indexes on (user_id, timestamp) and
(resource_type, resource_id) keep both "show me events for user X"
and "show me events on resource Y" fast at scale.

Return per-resource allowed actions for the current user.

Use this to render the UI permission gate (greyed-out buttons etc.) without
flooding the audit log with denied probes. Empty list for a resource_id
means the user cannot perform any of the requested actions on that resource.

List role assignments scoped to one user.

* Omitting user_id defaults to the caller — no superuser needed.
* Passing user_id == self.id is the same as omitting it.
* Passing a different user_id requires superuser; otherwise 403.

Results are always filtered by the resolved user_id. Admins who need
cross-user lookups make one call per user. Paginated via limit /
offset (default 100, max 200).

Assign a role to a user. Superuser-only.

List role assignments scoped to one user.

* Omitting user_id defaults to the caller — no superuser needed.
* Passing user_id == self.id is the same as omitting it.
* Passing a different user_id requires superuser; otherwise 403.

Results are always filtered by the resolved user_id. Admins who need
cross-user lookups make one call per user. Paginated via limit /
offset (default 100, max 200).

Assign a role to a user. Superuser-only.

Revoke a role assignment. Superuser-only.

List roles. Open to authenticated users so the UI can populate dropdowns.

Paginated via limit / offset so a single call cannot return the
entire catalog of roles + their permissions. Stable order is (name, id)
so offset is deterministic across calls.

Create a custom (non-system) role. Superuser-only.

List roles. Open to authenticated users so the UI can populate dropdowns.

Paginated via limit / offset so a single call cannot return the
entire catalog of roles + their permissions. Stable order is (name, id)
so offset is deterministic across calls.

Create a custom (non-system) role. Superuser-only.

Delete a custom role.

System roles cannot be deleted; roles with active assignments return 409
(delete the assignments first).

Update fields on a custom role. System roles are read-only.

List share rows visible to the caller (paginated, max 200).

Create an authz_share row for a resource.

List share rows visible to the caller (paginated, max 200).

Create an authz_share row for a resource.

Revoke an existing share.

Fetch a single share by id with the same visibility rules as list.

Update the permission level of an existing share.

List teams. Open to any authenticated user (for the share dialog's team picker).

Paginated via limit / offset so a single call cannot enumerate every
team. Stable order is (team_name, id) so offset is deterministic.