langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Dataset-scoped Service API keys: reads succeed, writes fail (Invalid user account / 500). Is this plan-related? #18310

New Issue
Closed
opened 2026-02-21 19:46:08 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 19:46:08 -05:00
Owner
Copy Link
Copy Source

Originally created by @jtinnerello1 on GitHub (Sep 26, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

Version 1.9.0

Cloud or Self Hosted

Cloud

Steps to reproduce

Steps to Reproduce

Generate a dataset-scoped Service API key for dataset:
eb84e0d5-db28-4f16-9473-47a716a93833
Key prefix/suffix: dataset-5Rlg8F…Mc1

Run a read request (succeeds):

curl -i -X GET "https://api.dify.ai/v1/datasets/eb84e0d5-db28-4f16-9473-47a716a93833/documents?limit=1" `
-H "Authorization: Bearer dataset-5Rlg8F…Mc1"

→ ✅ 200 OK, returns documents.

Run a write request with text (fails):

$Body = @{
name = "probe.txt"
text = "ping from contracts_v2"
indexing_technique = "high_quality"
} | ConvertTo-Json -Compress

curl -i -X POST "https://api.dify.ai/v1/datasets/eb84e0d5-db28-4f16-9473-47a716a93833/document/create-by-text" -H "Authorization: Bearer dataset-5Rlg8F…Mc1"
-H "Content-Type: application/json" `
--data $Body

→ ❌ 500 Internal Server Error

Run a write request with file (fails):

$PdfPath = "C:\Users\jtinn\Downloads\Sample Homeowners Insurance Policy.pdf"
$Data = @{ indexing_technique = "high_quality"; process_rule = @{ rules = @{} } } | ConvertTo-Json -Compress

curl -i -X POST "https://api.dify.ai/v1/datasets/eb84e0d5-db28-4f16-9473-47a716a93833/document/create-by-file" -H "Authorization: Bearer dataset-5Rlg8F…Mc1"
-H "accept: application/json" -H "Content-Type: multipart/form-data"
--form "file=@$PdfPath;type=application/pdf" `
--form "data=$Data"

→ ❌ 400 Invalid user account

Upload the same file via the UI (Knowledge → Upload → Save & Process).
→ ✅ Upload succeeds, document ingests properly.

dify_api_repro_transcript_2025-09-26.txt

dify_env_summary_2025-09-26.txt

✔️ Expected Behavior

Context
I do not see a Personal Settings → API Keys menu in my workspace, so I cannot generate a user-scoped Service API key to test the suggested workaround.

DosuBot mentioned this might be due to my plan or workspace type not supporting user-scoped keys.

Questions
Is the failure of dataset-scoped keys for writes a regression/bug, or is this an intentional plan limitation?

If it is plan-related, should I upgrade to gain access to user-scoped Service API keys for write operations?

If not plan-related, can you provide a fix or an alternate workaround so we can use the Service API for document ingestion?

Expected Behavior
Dataset-scoped keys should support both read and write (as documented), or clear guidance should exist on which key types work for uploads.

Dataset-scoped keys should authorize both read and write operations for the dataset they belong to.

create-by-file and create-by-text should succeed the same way GET documents does, since the account has write rights in the UI.

Questions for the Team
Is this a bug/regression in backend key-to-user mapping, or is it a plan limitation?

If plan-related, should I upgrade to get access to user-scoped keys to resolve this?

If not plan-related, is there a fix or alternate workaround you can recommend until the bug is resolved?

❌ Actual Behavior

Actual Behavior
Reads work: GET /datasets/:id/documents returns 200 OK.

Writes fail:

  • POST /datasets/:id/document/create-by-text → 500 Internal Server Error
  • POST /datasets/:id/document/create-by-file → 400 Invalid user account

UI uploads work fine, confirming the account has write permissions.

No Personal Settings → API Keys option available in this workspace, so we cannot test the suggested workaround of using a user-scoped Service API key.

Originally created by @jtinnerello1 on GitHub (Sep 26, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version Version 1.9.0 ### Cloud or Self Hosted Cloud ### Steps to reproduce Steps to Reproduce Generate a dataset-scoped Service API key for dataset: eb84e0d5-db28-4f16-9473-47a716a93833 Key prefix/suffix: dataset-5Rlg8F…Mc1 Run a read request (succeeds): curl -i -X GET "https://api.dify.ai/v1/datasets/eb84e0d5-db28-4f16-9473-47a716a93833/documents?limit=1" ` -H "Authorization: Bearer dataset-5Rlg8F…Mc1" → ✅ 200 OK, returns documents. Run a write request with text (fails): $Body = @{ name = "probe.txt" text = "ping from contracts_v2" indexing_technique = "high_quality" } | ConvertTo-Json -Compress curl -i -X POST "https://api.dify.ai/v1/datasets/eb84e0d5-db28-4f16-9473-47a716a93833/document/create-by-text" ` -H "Authorization: Bearer dataset-5Rlg8F…Mc1" ` -H "Content-Type: application/json" ` --data $Body → ❌ 500 Internal Server Error Run a write request with file (fails): $PdfPath = "C:\Users\jtinn\Downloads\Sample Homeowners Insurance Policy.pdf" $Data = @{ indexing_technique = "high_quality"; process_rule = @{ rules = @{} } } | ConvertTo-Json -Compress curl -i -X POST "https://api.dify.ai/v1/datasets/eb84e0d5-db28-4f16-9473-47a716a93833/document/create-by-file" ` -H "Authorization: Bearer dataset-5Rlg8F…Mc1" ` -H "accept: application/json" ` -H "Content-Type: multipart/form-data" ` --form "file=@$PdfPath;type=application/pdf" ` --form "data=$Data" → ❌ 400 Invalid user account Upload the same file via the UI (Knowledge → Upload → Save & Process). → ✅ Upload succeeds, document ingests properly. [dify_api_repro_transcript_2025-09-26.txt](https://github.com/user-attachments/files/22557292/dify_api_repro_transcript_2025-09-26.txt) [dify_env_summary_2025-09-26.txt](https://github.com/user-attachments/files/22557311/dify_env_summary_2025-09-26.txt) ### ✔️ Expected Behavior Context I do not see a Personal Settings → API Keys menu in my workspace, so I cannot generate a user-scoped Service API key to test the suggested workaround. DosuBot mentioned this might be due to my plan or workspace type not supporting user-scoped keys. Questions Is the failure of dataset-scoped keys for writes a regression/bug, or is this an intentional plan limitation? If it is plan-related, should I upgrade to gain access to user-scoped Service API keys for write operations? If not plan-related, can you provide a fix or an alternate workaround so we can use the Service API for document ingestion? Expected Behavior Dataset-scoped keys should support both read and write (as documented), or clear guidance should exist on which key types work for uploads. Dataset-scoped keys should authorize both read and write operations for the dataset they belong to. create-by-file and create-by-text should succeed the same way GET documents does, since the account has write rights in the UI. Questions for the Team Is this a bug/regression in backend key-to-user mapping, or is it a plan limitation? If plan-related, should I upgrade to get access to user-scoped keys to resolve this? If not plan-related, is there a fix or alternate workaround you can recommend until the bug is resolved? ### ❌ Actual Behavior Actual Behavior Reads work: GET /datasets/:id/documents returns 200 OK. Writes fail: - POST /datasets/:id/document/create-by-text → 500 Internal Server Error - POST /datasets/:id/document/create-by-file → 400 Invalid user account UI uploads work fine, confirming the account has write permissions. No Personal Settings → API Keys option available in this workspace, so we cannot test the suggested workaround of using a user-scoped Service API key.
yindo added the 🐞 bug label 2026-02-21 19:46:08 -05:00
yindo closed this issue 2026-02-21 19:46:08 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#18310
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?