# Data flow — langflow-ai/langflow

> Canonical page: https://codevetter.com/unpack/langflow/data-flow

# Data flow — langflow-ai/langflow

Scanned commit 5621dcfd84e11108e4cc1ecb0c51f41053c4211c (2026-09-15). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The core data path is: flow JSON (nodes+edges) persisted in the `flow` SQLModel table -> loaded owner-scoped or share-aware -> optionally sanitized by caller-aware component policy -> tweaks applied -> Graph.from_payload compiles vertices/edges -> graph.arun executes vertices and emits events -> RunResponse/SSE to the caller while messages, transactions, and vertex_builds rows persist execution history. Secrets (global variables, API keys) are Fernet-encrypted at rest using LANGFLOW_SECRET_KEY. Files go through a local/S3 StorageService namespaced per flow. Components themselves are discovered at boot from built-ins, components_path dirs, extension bundles, and remote bundle URLs, and cached in component_cache.
- Flow persistence: Flow rows store the graph as `data` JSON (nodes/edges/viewport) with name/endpoint_name/access_type/webhook/mcp_enabled metadata; cascade_delete_flow manually deletes MessageTable, TransactionTable, VertexBuildTable, FlowVersion, SpanTable/TraceTable, AuthzShare and the Flow row because SQLite FK cascades are not guaranteed. — [src/backend/base/langflow/services/database/models/flow/model.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/database/models/flow/model.py) [src/backend/base/langflow/api/utils/flow_utils.py#L103-141](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/utils/flow_utils.py#L103-L141)
- Graph materialization: simple_run_flow loads flow.data, applies caller-aware component policy (prepare_flow_build_for_user), then either serves a warm-registry template (try_warm_run_graph) or runs process_tweaks + apply_global_variable_defaults + Graph.from_payload(payload, flow_id, user_id, context). — [src/backend/base/langflow/api/v1/endpoints.py#L382-452](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L382-L452) [src/lfx/src/lfx/graph/graph/base.py#L1777](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/graph/graph/base.py#L1777)
- Tweaks and targeted inputs mutate the graph payload pre-instantiation via lfx.processing.process.process_tweaks/validate_targeted_inputs; refused tweaks raise TweakRefusedError mapped to a structured 422 (code TWEAKS_REFUSED) by an app-level handler, and non-owners are blocked from tweaking stored flows by _enforce_owner_only_tweaks. — [src/lfx/src/lfx/processing/process.py#L48-60](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/processing/process.py#L48-L60) [src/backend/base/langflow/main.py#L1047-1066](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L1047-L1066) [src/backend/base/langflow/api/v1/endpoints.py#L136-146](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L136-L146)
- Execution: run_graph_internal sets graph.session_id then awaits graph.arun(inputs..., outputs, stream, event_manager); results return as list[RunOutputs] -> RunResponse; v1 responses and SSE frames re-project content_blocks via project_payload_to_v1 to keep the 1.11 wire shape. — [src/lfx/src/lfx/processing/process.py#L62-108](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/processing/process.py#L62-L108) [src/backend/base/langflow/api/v1/endpoints.py#L682-709](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L682-L709)
- Streaming events: build/run events are produced into an asyncio.Queue owned by JobQueueService.create_queue(job_id) and consumed by get_build_events/consume_and_yield; a RedisJobQueueService backend (LANGFLOW_JOB_QUEUE_TYPE=redis) shares queues across gunicorn workers and is connectivity-probed at startup. — [src/backend/base/langflow/services/job_queue/service.py#L22-50](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/job_queue/service.py#L22-L50) [src/backend/base/langflow/services/utils.py#L716-731](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/utils.py#L716-L731) [src/backend/base/langflow/api/v1/endpoints.py#L712-745](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L712-L745)
- Credential storage: DatabaseVariableService stores global variables; CREDENTIAL_TYPE values are Fernet-encrypted/decrypted via auth service helpers keyed on LANGFLOW_SECRET_KEY — short secrets derive the key with SHA-256, and a MultiFernet retains a legacy PRNG-derived key for decrypting pre-1.10.1 ciphertext. — [src/backend/base/langflow/services/variable/service.py#L27-38](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/variable/service.py#L27-L38) [src/backend/base/langflow/services/auth/utils.py#L416-480](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/auth/utils.py#L416-L480)
- File inputs for public flows are restricted to the `{source_flow_id}/{basename}` namespace by validate_public_files (mitigation for GHSA-rcjh-r59h-gq37), and session IDs for anonymous public runs are namespaced per (client_id, flow_id) by scope_session_to_namespace / compute_virtual_flow_id (CVE-2026-33017). — [src/backend/base/langflow/api/utils/flow_utils.py#L144-218](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/utils/flow_utils.py#L144-L218)
- Component discovery at boot: lifespan calls get_and_cache_all_types_dict (lfx.interface.components) which merges built-in lfx components, settings.components_path directories, extension components (import_extension_components over DiscoveredExtension records), and bundles downloaded from settings.bundle_urls into temp dirs by load_bundles_from_urls. — [src/backend/base/langflow/main.py#L395-428](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L395-L428) [src/lfx/src/lfx/interface/components.py#L1128-1191](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/interface/components.py#L1128-L1191) [src/backend/base/langflow/initial_setup/setup.py#L1103-1146](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/initial_setup/setup.py#L1103-L1146)
- Execution history is persisted per run: JobService.create_job writes a WORKFLOW job row, vertex builds and transactions land in VertexBuildTable/TransactionTable, and startup cleanup prunes both tables plus authz_audit_log to configured retention (max_transactions_to_keep, max_vertex_builds_to_keep, AUTHZ_AUDIT_RETENTION_DAYS). — [src/backend/base/langflow/api/v1/endpoints.py#L505-539](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L505-L539) [src/backend/base/langflow/services/utils.py#L464-558](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/utils.py#L464-L558) [src/backend/base/langflow/services/jobs/factory.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/jobs/factory.py)
- Per-request identity context: session cookie/API-key auth resolves through get_current_user_for_workflow/api_key_security; a serving-plane end-user header is merged into the effective session_id by resolve_serving_scope and stamped on graph.end_user_id while execution still runs as flow.user_id; execution_client/execution_protocol contextvars label the surface for tracing. — [src/backend/base/langflow/api/v1/endpoints.py#L453-481](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/endpoints.py#L453-L481) [src/backend/base/langflow/api/v2/workflow_host.py#L50-69](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v2/workflow_host.py#L50-L69) [src/lfx/src/lfx/graph/graph/base.py#L173-195](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/graph/graph/base.py#L173-L195)
- Durable/background runs: POST /api/v2/workflows mode=background dispatches to LangflowWorkflowHost.submit_background -> submit_background_with_mapping, with HITL pause/resume supported by a CheckpointService (lfx.graph.checkpoint CheckpointStore) and orphan sweeping on startup via background_execution service. — [src/backend/base/langflow/api/v2/workflow_host.py#L126-136](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v2/workflow_host.py#L126-L136) [src/backend/base/langflow/api/v2/hitl.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v2/hitl.py) [src/backend/base/langflow/main.py#L545-549](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L545-L549) [docs/features/durable-execution-hitl.md](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/docs/features/durable-execution-hitl.md)
- Outbound calls a boot makes: models.dev catalog refresh (daily task, disabled by LANGFLOW_MODELS_DEV_REFRESH=false), bundle URL fetches, store webhooks (LANGFLOW_DOWNLOAD_WEBHOOK_URL/LIKE_WEBHOOK_URL), GitHub archive downloads via detect_github_url, and version checks via fetch_latest_version. — [src/backend/base/langflow/main.py#L581-632](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L581-L632) [src/backend/base/langflow/initial_setup/setup.py#L1072-1100](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/initial_setup/setup.py#L1072-L1100) [.env.example#L206-217](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/.env.example#L206-L217) [src/backend/base/langflow/__main__.py#L63](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/__main__.py#L63)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)