---
title: "Execute Public Workflow"
method: POST
path: "/api/v2/workflows/public"
tags: ["Workflow (public)"]
---

# Execute Public Workflow

`POST /api/v2/workflows/public`

Stream a public flow on behalf of a shareable-playground visitor. Mirrors the security posture of /api/v1/build_public_tmp.

## Request body

- PublicWorkflowRunRequest — Request schema for ``POST /api/v2/workflows/public``. Narrower than ``WorkflowRunRequest`` so the public-flow surface stays locked down. Notably absent vs the regular body: - ``data`` — visitors must never override the stored flow definition. - ``tweaks`` — visitors must never override component parameters. The endpoint enforces the additional CVE mitigations that the regular endpoint does not need: - ``access_type == PUBLIC`` gate (others 403). - ``virtual_flow_id = uuid5(identifier, flow_id)`` so messages stay isolated per visitor. - Session string namespaced under the virtual flow id (CVE-2026-33017). - File-path validation (GHSA-rcjh-r59h-gq37). - Owner impersonation: the run executes under the flow owner's permissions, never the visitor's.
  - `files` string[], nullable — Optional list of pre-uploaded file paths. Each path must be scoped to this flow's own storage namespace; the endpoint rejects path traversal or cross-flow references.
  - `flow_id` string, required — UUID of the public flow to run.
  - `input_value` string — Chat-style input value.
  - `mode` 'stream' — Always ``stream``. Sync/background modes would widen the public attack surface (job polling, owner impersonation persists across queue boundaries) so the schema rejects them at the wire.
  - `session_id` string, nullable — Optional caller session. Always namespaced under the visitor's virtual flow id by the endpoint.
  - `start_component_id` string, nullable — Partial-run start component id.
  - `stop_component_id` string, nullable — Partial-run stop component id.
  - `stream_protocol` string — Wire protocol for streaming events. Defaults to ``langflow`` (raw EventManager payloads). ``agui`` emits AG-UI events. Unknown values return 422 with the available list.

## Response `200`

Workflow execution response

- union
  - object — Synchronous workflow execution response.
    - `created_timestamp` string
    - `errors` ErrorDetail[]
      - `code` string, nullable
      - `details` object, nullable
      - `error` string, required
    - `flow_id` string, required
    - `globals` object
    - `human_request` object, nullable — Set when ``status`` is ``suspended``: the human-input request the run paused on (``prompt``, ``options``, ``allowed_decisions``, ``request_id``). Resume by running the same session/task again with the chosen decision.
    - `inputs` object
    - `job_id` union
      - string
      - string, uuid
    - `object` 'response'
    - `output` WorkflowOutput — The run's primary text answer plus the reason it resolved that way.
      - `reason` 'single' | 'multiple' | 'none' | 'non_string' | 'failed', required — Why ``WorkflowOutput.text`` resolved the way it did. Mirrors the LLM-domain ``finish_reason`` / ``stop_reason`` convention: a machine-readable enum explaining the disposition of the answer, distinct from the lifecycle ``status``.
      - `source` string, nullable — Component id that produced ``text``. Set only when ``reason`` is ``single``.
      - `text` string, nullable — The run's text answer. Set only when ``reason`` is ``single``. Empty string is a valid answer.
    - `outputs` object
    - `session_id` string, nullable — The session the run executed under. Echoes the request ``session_id`` when provided, otherwise the server-generated one. Pass it back on the next call to continue the same chat history / memory thread.
    - `status` 'queued' | 'in_progress' | 'completed' | 'failed' | 'cancelled' | 'timed_out' | 'suspended', required — Job execution status.
  - object — Background job response.
    - `created_timestamp` string
    - `errors` ErrorDetail[]
      - `code` string, nullable
      - `details` object, nullable
      - `error` string, required
    - `flow_id` string, required
    - `globals` object
    - `job_id` union, required
      - string
      - string, uuid
    - `links` object
    - `object` 'job'
    - `status` 'queued' | 'in_progress' | 'completed' | 'failed' | 'cancelled' | 'timed_out' | 'suspended', required — Job execution status.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/langflow-ai/apis/langflow.md) · [All operations](https://skmtc.net/langflow-ai/apis/langflow/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/langflow-ai/langflow/revisions/22962dc5e81b/schema)