The /api/workflow-canvas/[id] GET endpoint validated the canvas id against the UUID format before hitting the database; a non-UUID value previously made Postgres throw an "invalid input syntax for type uuid" error and surface as a 500. It now answers with an honest 404 instead.