{
  "schemaVersion": "1.0",
  "title": "Dify capabilities",
  "description": "Use this index to choose the Dify family that owns a task and interpret its AIP contract before invocation. The reviewed frozen catalogue contains 79 provider operations. Each configured app also publishes one invocation alias.",
  "canonical": "https://getaip.org/docs/connectors/dify/capabilities",
  "route": "/docs/connectors/dify/capabilities",
  "source": "docs/connectors/dify/capabilities/README.md",
  "protocol": "Agent Interoperability Protocol",
  "protocolVersion": "1.0",
  "section": "Connectors",
  "documentType": "Connector",
  "language": "en",
  "downloads": {
    "md": "/docs/download/connectors/dify/capabilities.md",
    "txt": "/docs/download/connectors/dify/capabilities.txt",
    "json": "/docs/download/connectors/dify/capabilities.json",
    "pdf": "/docs/download/connectors/dify/capabilities.pdf"
  },
  "content": {
    "format": "text/markdown",
    "markdown": "---\ntitle: Dify capabilities\ndescription: >-\n  Choose a Dify capability family and interpret its mode, credential, risk,\n  approval, retry, transport, and side-effect contract\nkind: index\naudience: application-developer\nappliesTo: \"1.x\"\nwritingStandard: \"aip-docs/1.0\"\nlastReviewedRevision: \"97be86e9efedf07ecf1783b03800f683f107fb04\"\nconnector: dify\naliases:\n  - Dify capability index\n  - Dify Service API operations\n---\n\n# Dify capabilities\n\nUse this index to choose the Dify family that owns a task and interpret its AIP\ncontract before invocation. The reviewed frozen catalogue contains 79 provider\noperations. Each configured app also publishes one invocation alias.\n\nThe source-derived `../assets/capabilities.json` snapshot owns the ordered machine\ninventory. Focused pages own task guidance and interpretation; the snapshot\ndoes not replace runtime discovery or the source that constructs each contract.\n\n## Catalogue identity\n\n| Property | Reviewed value |\n|---|---|\n| AIP source | `97be86e9efedf07ecf1783b03800f683f107fb04` |\n| Pinned Dify source | `f8d47616c15d0959f604f6a5e2e1d32d3108991b` |\n| Connector profile | `aip.connector.dify.v1` |\n| App operations | 33 |\n| Knowledge operations | 46 |\n| Frozen operations | 79 |\n| Reads | 32 |\n| Mutations | 47 |\n| App invocation aliases | One per configured app |\n\nA matching suffix does not prove that a capability is discoverable. The app\nmode, configured credential, admitted manifest, tenant binding, artifact, and\nprovider baseline remain part of capability identity.\n\n## Choose a family\n\nEach frozen operation appears in exactly one family.\n\n| Family | Focused page | Total | Read | Mutation | Low | Medium | High | Approval | Retry |\n|---|---|---:|---:|---:|---:|---:|---:|---:|---:|\n| App metadata and files | `app-metadata-and-files.md` | 7 | 6 | 1 | 6 | 1 | 0 | 1 | 6 |\n| Chat, conversations, and feedback | `chat-messages-conversations-and-feedback.md` | 9 | 5 | 4 | 5 | 3 | 1 | 4 | 5 |\n| Workflows, streams, and human input | `workflows-streaming-and-human-input.md` | 9 | 4 | 5 | 4 | 4 | 1 | 5 | 4 |\n| Audio | `audio.md` | 2 | 0 | 2 | 0 | 2 | 0 | 2 | 0 |\n| Annotations | `annotations.md` | 6 | 2 | 4 | 2 | 2 | 2 | 4 | 2 |\n| Datasets, tags, and retrieval | `knowledge-datasets-tags-and-retrieval.md` | 13 | 4 | 9 | 4 | 7 | 2 | 9 | 4 |\n| Documents and indexing | `knowledge-documents-and-indexing.md` | 12 | 4 | 8 | 4 | 7 | 1 | 8 | 4 |\n| Segments and child chunks | `knowledge-segments-and-child-chunks.md` | 9 | 3 | 6 | 3 | 4 | 2 | 6 | 3 |\n| Metadata and models | `knowledge-metadata-and-models.md` | 8 | 3 | 5 | 3 | 4 | 1 | 5 | 3 |\n| Pipelines and uploads | `knowledge-pipelines-and-uploads.md` | 4 | 1 | 3 | 1 | 3 | 0 | 3 | 1 |\n| **Total** |  | **79** | **32** | **47** | **32** | **37** | **10** | **47** | **32** |\n\n`Retry` means connector contract support for that read. It does not authorize a\ncaller to repeat an Action without checking its identity, terminal state,\nbudget, and provider outcome.\n\n## Read capability IDs\n\nAn app invocation alias contains only the configured app ID:\n\n```text\ncap:dify:support-chat\n│        └────────── configured app\n└─────────────────── connector namespace\n```\n\nAn app catalogue operation appends a frozen suffix:\n\n```text\ncap:dify:support-chat:conversation.list\n│        │            └──────────────── operation\n│        └───────────────────────────── configured app\n└────────────────────────────────────── connector namespace\n```\n\nA Knowledge capability has an explicit credential domain:\n\n```text\ncap:dify:knowledge:main-workspace:dataset.list\n│        │         │              └──── operation\n│        │         └─────────────────── credential ID\n│        └───────────────────────────── Knowledge domain\n└────────────────────────────────────── connector namespace\n```\n\nDo not derive an ID from a Dify URL. Use authenticated tenant discovery and the\nadmitted manifest.\n\n## Calculate a configuration's surface\n\nOne app publishes its alias plus the operations supported by its mode:\n\n| Mode | App operations | Alias included | App capabilities |\n|---|---:|---:|---:|\n| `workflow` | 23 | 1 | 24 |\n| `completion` | 19 | 1 | 20 |\n| `chat` | 27 | 1 | 28 |\n| `advanced-chat` | 29 | 1 | 30 |\n| `agent-chat` | 27 | 1 | 28 |\n| `agent` | 27 | 1 | 28 |\n\nEach Knowledge credential adds 46 capabilities. The total is the sum across\nconfigured apps and Knowledge credentials. The host must still satisfy the\nglobal admitted-manifest limit, so descriptor parser maxima are not usable\nsurface maxima.\n\n## Distinguish credential scopes\n\n| Scope | Capability prefix | Credential |\n|---|---|---|\n| App alias and app operations | `cap:dify:<app_id>` | API key loaded for that app |\n| Knowledge operations | `cap:dify:knowledge:<credential_id>` | Workspace Knowledge API key |\n\nBinding metadata records the public credential ID, credential class, operation,\nprovider method, path template, and upstream revision. It never contains the\nBearer value.\n\n## Interpret methods and mutation class\n\n| Provider method | Count | AIP class |\n|---|---:|---|\n| `GET` | 32 | Read |\n| `POST` | 31 | Mutation |\n| `PUT` | 2 | Mutation |\n| `PATCH` | 6 | Mutation |\n| `DELETE` | 8 | Mutation |\n\nOnly `GET` is retry-safe in the frozen catalogue. A stop, status toggle, form\nsubmission, retrieval request, archive generation, or model execution remains\na mutation when its provider method is not `GET`.\n\n## Interpret kind and risk\n\n| Kind | Count | Meaning |\n|---|---:|---|\n| Tool | 73 | Normal app or Knowledge operation |\n| Workflow | 6 | Workflow run read, run-by-ID, stop, event stream, and human-input form operations |\n\nThe app invocation alias is a Workflow for `workflow` mode and an Agent for all\nother modes.\n\n| Risk | Count | Rule |\n|---|---:|---|\n| Low | 32 | Every `GET` |\n| Medium | 37 | Non-delete mutation except two named high-impact operations |\n| High | 10 | Every `DELETE`, `workflow.run_by_id`, and `annotation_reply.toggle` |\n\nRisk is policy input, not authorization. Medium and high mutations both require\napproval and idempotency.\n\n## Apply approval, idempotency, and retry\n\n| Contract | Catalogue read | Catalogue mutation | App invocation alias |\n|---|---|---|---|\n| Approval | No | Required | Required for workflow and agent-family modes |\n| Idempotency key | Optional | Required | Required |\n| Key scope | Tenant | Tenant | Tenant |\n| Collision behavior | Revalidate input hash | Revalidate input hash | Revalidate input hash |\n| Published TTL | 86400000 ms | 86400000 ms | 86400000 ms |\n| Connector retry support | Yes | No | No |\n| Retry safety | Safe | Unsafe | Unsafe |\n\nCatalogue approval uses tenant policy for 900,000 ms and requires a reason,\ninput snapshot, and policy decision. The absence of connector-required approval\non plain `chat` or `completion` aliases does not override deployment policy.\n\nAn idempotency key identifies one intent. It does not prove that Dify\ndeduplicates every route, stream, model invocation, or mutation. Preserve the\nsame Action and inspect provider state after an uncertain outcome.\n\n## Understand execution and response transport\n\n| Response kind | Count | AIP result |\n|---|---:|---|\n| JSON or UTF-8 | 74 | HTTP status, decoded body, optional content type and provider request ID |\n| Binary | 3 | HTTP status, base64 content, content type, size, and optional request ID |\n| Server-sent events | 2 | Bounded event handling and normalized result |\n\nThe two catalogue SSE operations are `workflow.run_by_id` and\n`workflow.event.stream`. The three binary operations are `file.preview`,\n`audio.synthesize`, and `document.download_zip`.\n\nSix operations use multipart input: `file.upload`, `audio.transcribe`, three\ndocument upload or update operations, and `pipeline.file.upload`. Every other\nfrozen operation uses path, query, and optional JSON input.\n\nApp invocation aliases separately support sync, async, streaming, and\ncancellation. Catalogue support is operation-specific.\n\n## Apply data and compensation rules\n\nAll 79 frozen operations and every app alias declare:\n\n- confidential data;\n- possible personal information;\n- required redaction;\n- external network side effects.\n\nReads add a read side effect. Mutations add a write side effect, require\napproval and a key, and declare `rollback_not_supported` with no compensating\ncapability. The connector publishes no transaction or reconciliation support.\n\n## Use the machine snapshot\n\nThe JSON asset contains source and upstream identities, aggregate counts, the\napp-alias contract, and one ordered record for every frozen operation. Each\nrecord includes ID template, family, scope, route, user placement, encoding,\ntransport, supported modes, kind, risk, approval, idempotency, execution, data,\nand compensation.\n\nIts reviewed SHA-256 is:\n\n```text\n7884f23e2abce41ea14e869d4202f497a2294ae931facd7917467624a7fc6019\n```\n\nThe snapshot is a source-derived review artifact. It does not prove registry\nadmission, tenant authorization, artifact qualification, or live Dify\ncompatibility.\n\n## Choose the next page\n\n- Use `app-metadata-and-files.md` for app discovery, end users, upload, and\n  preview.\n- Use `chat-messages-conversations-and-feedback.md` for chat history and state.\n- Use `workflows-streaming-and-human-input.md` for remote tasks and forms.\n- Use `audio.md` and `annotations.md` for their app-specific domains.\n- Use the five `knowledge-*.md` pages for workspace datasets, documents,\n  chunks, metadata, models, and pipelines.\n\n## Related documentation\n\n- [Source-derived capability snapshot](../assets/capabilities.json)\n- [Dify connector overview](../README.md)\n- [Dify connector configuration](../reference/configuration.md)\n- [Capabilities and contracts](../../../concepts/capabilities.md)\n- [Approvals and policy](../../../concepts/approvals-and-policy.md)\n",
    "text": "Dify capabilities\n\nUse this index to choose the Dify family that owns a task and interpret its AIP\ncontract before invocation. The reviewed frozen catalogue contains 79 provider\noperations. Each configured app also publishes one invocation alias.\n\nThe source-derived ../assets/capabilities.json snapshot owns the ordered machine\ninventory. Focused pages own task guidance and interpretation; the snapshot\ndoes not replace runtime discovery or the source that constructs each contract.\n\nCatalogue identity\n\n| Property | Reviewed value |\n\n| AIP source | 97be86e9efedf07ecf1783b03800f683f107fb04 |\n| Pinned Dify source | f8d47616c15d0959f604f6a5e2e1d32d3108991b |\n| Connector profile | aip.connector.dify.v1 |\n| App operations | 33 |\n| Knowledge operations | 46 |\n| Frozen operations | 79 |\n| Reads | 32 |\n| Mutations | 47 |\n| App invocation aliases | One per configured app |\n\nA matching suffix does not prove that a capability is discoverable. The app\nmode, configured credential, admitted manifest, tenant binding, artifact, and\nprovider baseline remain part of capability identity.\n\nChoose a family\n\nEach frozen operation appears in exactly one family.\n\n| Family | Focused page | Total | Read | Mutation | Low | Medium | High | Approval | Retry |\n\n| App metadata and files | app-metadata-and-files.md | 7 | 6 | 1 | 6 | 1 | 0 | 1 | 6 |\n| Chat, conversations, and feedback | chat-messages-conversations-and-feedback.md | 9 | 5 | 4 | 5 | 3 | 1 | 4 | 5 |\n| Workflows, streams, and human input | workflows-streaming-and-human-input.md | 9 | 4 | 5 | 4 | 4 | 1 | 5 | 4 |\n| Audio | audio.md | 2 | 0 | 2 | 0 | 2 | 0 | 2 | 0 |\n| Annotations | annotations.md | 6 | 2 | 4 | 2 | 2 | 2 | 4 | 2 |\n| Datasets, tags, and retrieval | knowledge-datasets-tags-and-retrieval.md | 13 | 4 | 9 | 4 | 7 | 2 | 9 | 4 |\n| Documents and indexing | knowledge-documents-and-indexing.md | 12 | 4 | 8 | 4 | 7 | 1 | 8 | 4 |\n| Segments and child chunks | knowledge-segments-and-child-chunks.md | 9 | 3 | 6 | 3 | 4 | 2 | 6 | 3 |\n| Metadata and models | knowledge-metadata-and-models.md | 8 | 3 | 5 | 3 | 4 | 1 | 5 | 3 |\n| Pipelines and uploads | knowledge-pipelines-and-uploads.md | 4 | 1 | 3 | 1 | 3 | 0 | 3 | 1 |\n| Total |  | 79 | 32 | 47 | 32 | 37 | 10 | 47 | 32 |\n\nRetry means connector contract support for that read. It does not authorize a\ncaller to repeat an Action without checking its identity, terminal state,\nbudget, and provider outcome.\n\nRead capability IDs\n\nAn app invocation alias contains only the configured app ID:\n\ncap:dify:support-chat\n│        └────────── configured app\n└─────────────────── connector namespace\n\nAn app catalogue operation appends a frozen suffix:\n\ncap:dify:support-chat:conversation.list\n│        │            └──────────────── operation\n│        └───────────────────────────── configured app\n└────────────────────────────────────── connector namespace\n\nA Knowledge capability has an explicit credential domain:\n\ncap:dify:knowledge:main-workspace:dataset.list\n│        │         │              └──── operation\n│        │         └─────────────────── credential ID\n│        └───────────────────────────── Knowledge domain\n└────────────────────────────────────── connector namespace\n\nDo not derive an ID from a Dify URL. Use authenticated tenant discovery and the\nadmitted manifest.\n\nCalculate a configuration's surface\n\nOne app publishes its alias plus the operations supported by its mode:\n\n| Mode | App operations | Alias included | App capabilities |\n\n| workflow | 23 | 1 | 24 |\n| completion | 19 | 1 | 20 |\n| chat | 27 | 1 | 28 |\n| advanced-chat | 29 | 1 | 30 |\n| agent-chat | 27 | 1 | 28 |\n| agent | 27 | 1 | 28 |\n\nEach Knowledge credential adds 46 capabilities. The total is the sum across\nconfigured apps and Knowledge credentials. The host must still satisfy the\nglobal admitted-manifest limit, so descriptor parser maxima are not usable\nsurface maxima.\n\nDistinguish credential scopes\n\n| Scope | Capability prefix | Credential |\n\n| App alias and app operations | cap:dify: | API key loaded for that app |\n| Knowledge operations | cap:dify:knowledge: | Workspace Knowledge API key |\n\nBinding metadata records the public credential ID, credential class, operation,\nprovider method, path template, and upstream revision. It never contains the\nBearer value.\n\nInterpret methods and mutation class\n\n| Provider method | Count | AIP class |\n\n| GET | 32 | Read |\n| POST | 31 | Mutation |\n| PUT | 2 | Mutation |\n| PATCH | 6 | Mutation |\n| DELETE | 8 | Mutation |\n\nOnly GET is retry-safe in the frozen catalogue. A stop, status toggle, form\nsubmission, retrieval request, archive generation, or model execution remains\na mutation when its provider method is not GET.\n\nInterpret kind and risk\n\n| Kind | Count | Meaning |\n\n| Tool | 73 | Normal app or Knowledge operation |\n| Workflow | 6 | Workflow run read, run-by-ID, stop, event stream, and human-input form operations |\n\nThe app invocation alias is a Workflow for workflow mode and an Agent for all\nother modes.\n\n| Risk | Count | Rule |\n\n| Low | 32 | Every GET |\n| Medium | 37 | Non-delete mutation except two named high-impact operations |\n| High | 10 | Every DELETE, workflow.runbyid, and annotationreply.toggle |\n\nRisk is policy input, not authorization. Medium and high mutations both require\napproval and idempotency.\n\nApply approval, idempotency, and retry\n\n| Contract | Catalogue read | Catalogue mutation | App invocation alias |\n\n| Approval | No | Required | Required for workflow and agent-family modes |\n| Idempotency key | Optional | Required | Required |\n| Key scope | Tenant | Tenant | Tenant |\n| Collision behavior | Revalidate input hash | Revalidate input hash | Revalidate input hash |\n| Published TTL | 86400000 ms | 86400000 ms | 86400000 ms |\n| Connector retry support | Yes | No | No |\n| Retry safety | Safe | Unsafe | Unsafe |\n\nCatalogue approval uses tenant policy for 900,000 ms and requires a reason,\ninput snapshot, and policy decision. The absence of connector-required approval\non plain chat or completion aliases does not override deployment policy.\n\nAn idempotency key identifies one intent. It does not prove that Dify\ndeduplicates every route, stream, model invocation, or mutation. Preserve the\nsame Action and inspect provider state after an uncertain outcome.\n\nUnderstand execution and response transport\n\n| Response kind | Count | AIP result |\n\n| JSON or UTF-8 | 74 | HTTP status, decoded body, optional content type and provider request ID |\n| Binary | 3 | HTTP status, base64 content, content type, size, and optional request ID |\n| Server-sent events | 2 | Bounded event handling and normalized result |\n\nThe two catalogue SSE operations are workflow.runbyid and\nworkflow.event.stream. The three binary operations are file.preview,\naudio.synthesize, and document.downloadzip.\n\nSix operations use multipart input: file.upload, audio.transcribe, three\ndocument upload or update operations, and pipeline.file.upload. Every other\nfrozen operation uses path, query, and optional JSON input.\n\nApp invocation aliases separately support sync, async, streaming, and\ncancellation. Catalogue support is operation-specific.\n\nApply data and compensation rules\n\nAll 79 frozen operations and every app alias declare:\n• confidential data;\n• possible personal information;\n• required redaction;\n• external network side effects.\n\nReads add a read side effect. Mutations add a write side effect, require\napproval and a key, and declare rollbacknotsupported with no compensating\ncapability. The connector publishes no transaction or reconciliation support.\n\nUse the machine snapshot\n\nThe JSON asset contains source and upstream identities, aggregate counts, the\napp-alias contract, and one ordered record for every frozen operation. Each\nrecord includes ID template, family, scope, route, user placement, encoding,\ntransport, supported modes, kind, risk, approval, idempotency, execution, data,\nand compensation.\n\nIts reviewed SHA-256 is:\n\n7884f23e2abce41ea14e869d4202f497a2294ae931facd7917467624a7fc6019\n\nThe snapshot is a source-derived review artifact. It does not prove registry\nadmission, tenant authorization, artifact qualification, or live Dify\ncompatibility.\n\nChoose the next page\n• Use app-metadata-and-files.md for app discovery, end users, upload, and\n  preview.\n• Use chat-messages-conversations-and-feedback.md for chat history and state.\n• Use workflows-streaming-and-human-input.md for remote tasks and forms.\n• Use audio.md and annotations.md for their app-specific domains.\n• Use the five knowledge-.md pages for workspace datasets, documents,\n  chunks, metadata, models, and pipelines.\n\nRelated documentation\n• Source-derived capability snapshot (../assets/capabilities.json)\n• Dify connector overview (../README.md)\n• Dify connector configuration (../reference/configuration.md)\n• Capabilities and contracts (../../../concepts/capabilities.md)\n• Approvals and policy (../../../concepts/approvals-and-policy.md)\n"
  },
  "integrity": {
    "algorithm": "sha256",
    "sourceDigest": "074de4505f52a086991eed892bceb8484eb692e184607f24d912f533fb6b5e62"
  }
}