Tools
Dify knowledge base API keys can finally be scoped to a single dataset instead of the whole workspace
Until 1.17.1 a knowledge base service-API key could read and write every knowledge base in the tenant, so wiring an integration to one dataset handed it all of them. Keys can now be bound to specific knowledge bases at creation time via a workspace / this-knowledge-base selector, and a bound key returns 403 for any other dataset on both document and retrieval endpoints, plus on endpoints carrying no dataset ID such as list-all. Existing keys stay unbound and workspace-wide, so the fix is opt-in on upgrade.
Source
↳ Follow the thread