Ambiguous route contracts in tools and chatmessage endpoints accept / even when controller requires /:id

[sahil2448]

Describe the bug

Some API routes are currently registered with both / and /:id, but the corresponding controller methods require req.params.id.

The route layer says / is valid, while the controller rejects it with 412 (id not provided). This is easy to miss because the current frontend mostly calls the /:id paths, so regular UI flows still work. However, the contract is inconsistent and can cause future integration issues, confusing errors, and brittle tests.

To Reproduce

1. Start Flowise locally.
2. Call endpoints that are currently mapped to both / and /:id but need id, for example:
   • PUT /api/v1/tools
   • DELETE /api/v1/tools
   • GET /api/v1/chatmessage
   • DELETE /api/v1/chatmessage
3. Observe that request reaches controller and fails with 412 due to missing id.

Example Calls

curl -X DELETE http://localhost:3000/api/v1/tools
curl -X GET http://localhost:3000/api/v1/chatmessage

Expected behavior

If an endpoint semantically requires an id, only /:id should be registered for that handler.

The / path should not be wired to id-required handlers. This keeps route contract clear and prevents avoidable 412 responses caused by ambiguous route definitions.

Screenshots

No screenshot needed for this one (behavior can be reproduced with API calls).

Flow

N/A

Use Method

pnpm start

Flowise Version

3.1.2

Operating System

Windows

Browser

Other

Additional context

Affected routes observed

packages/server/src/routes/tools/index.ts
router.get(['/', '/:id'], ...getToolById)
router.put(['/', '/:id'], ...updateTool)
router.delete(['/', '/:id'], ...deleteTool)

packages/server/src/routes/chat-messages/index.ts
router.get(['/', '/:id'], ...getAllChatMessages)
router.delete(['/', '/:id'], ...removeAllChatMessages)

Related controllers already require req.params.id

packages/server/src/controllers/tools/index.ts
packages/server/src/controllers/chat-messages/index.ts

Suggested direction

• Keep list/read-all handlers on / where appropriate.
• Keep item/update/delete handlers on /:id only when id is mandatory.