langflow-ai/langflow

The v1 API (~35 routers under /api/v1) covers flow CRUD and sharing, graph build/run (job-queue + SSE), webhooks, files, variables, users/API keys, folders/projects, knowledge bases, memories, monitor/traces, a Langflow Store client, voice mode, A2A, an OpenAI-compatible responses route, MCP servers (global and per-project), and a full authz administration surface (shares, roles, assignments, teams, audit, me). v2 under /api/v2 hosts the workflow execution contract (sync/stream/background runs via a shared lfx router bound to a Langflow host), v2 files/MCP, and registration. Beyond HTTP there is the `lfx` executor CLI (run/serve a flow without the DB), `lfx-mcp`, a Python SDK, and a feature-gated 'agentic experience' with its own routers.

• Flow management: api/v1/flows.py implements POST/GET/PATCH/PUT upsert/DELETE plus batch create, upload/download of flow JSON, basic_examples, and a note_translations + expand_compact_flow endpoint; flow rows carry name, data JSON, endpoint_name, webhook/mcp_enabled flags, access_type PRIVATE|PUBLIC, folder/workspace scoping.
  src/backend/base/langflow/api/v1/flows.py#L289-490src/backend/base/langflow/services/database/models/flow/model.py
• Synchronous and streaming flow execution: POST /api/v1/run/{flow_id_or_name} (and a session-scoped variant) plus POST /api/v1/webhook/{flow_id_or_name} with an SSE webhook-events stream; all funnel through _run_flow_internal -> simple_run_flow.
  src/backend/base/langflow/api/v1/endpoints.py#L1082-1151src/backend/base/langflow/api/v1/endpoints.py#L1236-1330src/backend/base/langflow/api/v1/endpoints.py#L884-1050
• Editor build pipeline: POST /api/v1/build/{flow_id}/flow returns a job_id; GET /api/v1/build/{job_id}/events polls SSE (or event_delivery=direct streams inline); plus cancel_build, deprecated vertex-order/vertex-build endpoints, and public unauthenticated variants build_public_tmp.
  src/backend/base/langflow/api/v1/chat.py#L304-477src/backend/base/langflow/api/v1/chat.py#L479-545src/backend/base/langflow/api/v1/chat.py#L995-1299
• v2 workflow API: POST /api/v2/workflows is owned by the shared lfx.workflow.router.create_workflow_router bound to LangflowWorkflowHost, which supplies resolve_caller (session cookie/API key), get_flow (share-aware fetch), authorize (WorkflowAction->FlowAction), run_sync, stream_response, and submit_background; langflow keeps its own GET status/POST stop/GET events durable routes.
  src/backend/base/langflow/api/router.py#L141-164src/backend/base/langflow/api/v2/workflow_host.pysrc/backend/base/langflow/api/v2/workflow_background.py
• MCP integration is bidirectional: api/v1/mcp.py runs an MCP server exposing flows as tools over SSE (SseServerTransport) and Streamable HTTP (StreamableHTTPSessionManager, started in the lifespan), api/v1/mcp_projects.py runs per-project MCP servers, and an MCPComposerService plus an agentic MCP router exist; client-side MCP sessions are pooled by MCPSessionManager tunables.
  src/backend/base/langflow/api/v1/mcp.py#L1-60src/backend/base/langflow/api/v1/mcp.py#L147-326src/backend/base/langflow/api/v1/mcp_projects.py.env.example#L185-204
• Authentication surface: POST /api/v1/login (OAuth2 password form -> JWT access+refresh), GET /auto_login, POST /refresh, /logout, users CRUD, api_key CRUD; API-key auth is via x-api-key header/query validated against DB keys or a single LANGFLOW_API_KEY when LANGFLOW_API_KEY_SOURCE=env.
  src/backend/base/langflow/api/v1/login.py#L34-249.env.example#L118-131src/backend/tests/unit/test_api_key_source.py
• RBAC/authorization administration: /api/v1/authz/* routers (shares CRUD with an OSS owner floor, roles, role assignments, teams, me, and a superuser-only audit query capped at 200/page) sit behind guards in services/authorization; the feature is off by default (LANGFLOW_AUTHZ_ENABLED=false) with an OSS pass-through service.
  src/backend/base/langflow/api/router.py#L101-106src/backend/base/langflow/api/v1/authz_shares.pysrc/backend/base/langflow/api/v1/authz_audit.pysrc/backend/base/langflow/services/authorization/guards.py
• File handling: /api/v1/files upload/download (multipart boundary validated by middleware) and v2 files; the StorageService abstracts local disk vs S3 (services/storage/local.py, s3.py).
  src/backend/base/langflow/api/v1/files.pysrc/backend/base/langflow/main.py#L924-957src/backend/base/langflow/services/storage/s3.py
• Governance/policy surfaces: model_provider_policy, catalog_policy, policy_bundle routers administer which providers/components a project may use; a model_provider_policy_refresh_worker runs per worker at startup.
  src/backend/base/langflow/api/router.py#L99-107src/backend/base/langflow/services/model_provider_policy.pysrc/backend/base/langflow/services/task/model_provider_policy_refresh.py
• Interoperability endpoints: voice_mode router (voice), a2a.py (agent-to-agent protocol, gated per-request by LANGFLOW_A2A_ENABLED), openai_responses.py (OpenAI-compatible /responses), and a store.py client to api.langflow.store for sharing components.
  src/backend/base/langflow/api/v1/voice_mode.pysrc/backend/base/langflow/api/v1/a2a.pysrc/backend/base/langflow/api/v1/openai_responses.pysrc/backend/base/langflow/api/v1/store.py
• Feature-gated 'agentic experience': _include_agentic_router() mounts agentic_router plus files/sessions routers behind require_agentic_experience and an agentic MCP router; sandbox-management endpoints share the gate while /agentic/check-config stays readable.
  src/backend/base/langflow/api/router.py#L117-135src/backend/base/langflow/agentic/api/router.py
• lfx CLI is a standalone Typer app (`lfx`, plus `lfx-mcp`) with registered command groups: setup, observability, prewarm, authoring, upgrade, extension, running (`lfx run`, `lfx serve` which serves flow JSON/Python scripts as an HTTP API via a FlowRegistry), and remote.
  src/lfx/src/lfx/__main__.pysrc/lfx/src/lfx/cli/_running_commands.pysrc/lfx/src/lfx/cli/commands.py#L261-340src/lfx/pyproject.toml#L114-116
• Component catalog: ~108 component subdirectories under src/lfx/src/lfx/components (providers, vectorstores, embeddings, tools, agents, io, ...) plus curated lfx-* bundles under src/bundles (openai, anthropic, amazon, google, datastax, docling, ...) that ship extension.json manifests.
  src/lfx/src/lfx/componentssrc/bundles/openai/pyproject.toml#L36-50
• langflow-sdk is a separate workspace package (src/sdk) shipping a typed Python client with sync/async clients, background-job polling, environments, and pytest helpers for testing against a Langflow server.
  src/sdk/src/langflow_sdk/client.pysrc/sdk/src/langflow_sdk/_async_client.pysrc/sdk/pyproject.toml