{
  "schemaVersion": "1.0",
  "title": "Dify connector configuration",
  "description": "This reference describes the product settings accepted by aip-host-dify at the reviewed source revision. A complete process combines these settings with the shared connector-host identity, storage, routing, signing, lifecycle, and optional ",
  "canonical": "https://getaip.org/docs/connectors/dify/reference/configuration",
  "route": "/docs/connectors/dify/reference/configuration",
  "source": "docs/connectors/dify/reference/configuration.md",
  "protocol": "Agent Interoperability Protocol",
  "protocolVersion": "1.0",
  "section": "Connectors",
  "documentType": "Connector",
  "language": "en",
  "downloads": {
    "md": "/docs/download/connectors/dify/reference/configuration.md",
    "txt": "/docs/download/connectors/dify/reference/configuration.txt",
    "json": "/docs/download/connectors/dify/reference/configuration.json",
    "pdf": "/docs/download/connectors/dify/reference/configuration.pdf"
  },
  "content": {
    "format": "text/markdown",
    "markdown": "---\ntitle: Dify connector configuration\ndescription: >-\n  Look up Dify host settings, descriptor formats, defaults, limits, health\n  probes, and reload boundaries\nkind: reference\naudience: operator\nappliesTo: \"1.x\"\nwritingStandard: \"aip-docs/1.0\"\nlastReviewedRevision: \"97be86e9efedf07ecf1783b03800f683f107fb04\"\nconnector: dify\naliases:\n  - Dify environment variables\n  - Dify host settings\n  - Dify limits\n---\n\n# Dify connector configuration\n\nThis reference describes the product settings accepted by `aip-host-dify` at\nthe reviewed source revision. A complete process combines these settings with\nthe shared connector-host identity, storage, routing, signing, lifecycle, and\noptional stream-callback settings.\n\nAll Dify product settings and key files are read at startup. Only the shared\nnon-secret credential-revision policy is re-read before provider side effects.\n\n## Configuration identity\n\n| Property | Value |\n|---|---|\n| Binary | `aip-host-dify` |\n| AIP workspace version | `1.0.0` |\n| Reviewed AIP source | `97be86e9efedf07ecf1783b03800f683f107fb04` |\n| Connector ID | `dify` |\n| Connector profile | `aip.connector.dify.v1` |\n| Pinned Dify source | `f8d47616c15d0959f604f6a5e2e1d32d3108991b` |\n| Frozen operation catalogue | 33 app operations and 46 Knowledge operations |\n\nEnvironment variables and flags contain non-secret values or file paths. API\nkeys, database credentials, and signing seeds belong in bounded\nowner-controlled files.\n\n## Dify-specific settings\n\n| Environment variable | Command-line flag | Required | Default | Meaning |\n|---|---|---:|---|---|\n| `AIP_DIFY_BASE_URL` | `--base-url` | Yes | None | Fixed Dify origin shared by this host |\n| `AIP_DIFY_API_KEY_FILE` | `--api-key-file` | No | Per-app files | Legacy key shared intentionally by all configured apps |\n| `AIP_DIFY_APPS_FILE` | `--apps-file` | Conditional | Empty app set | JSON array of app descriptors |\n| `AIP_DIFY_KNOWLEDGE_FILE` | `--knowledge-file` | Conditional | Empty Knowledge set | JSON array of Knowledge credentials |\n| `AIP_DIFY_MAX_RESPONSE_BYTES` | `--max-response-bytes` | No | `8388608` | Maximum blocking response or complete event stream |\n\nAt least one app or Knowledge descriptor is required. A host may serve only\napps, only Knowledge, or both domains.\n\n## Configure application descriptors\n\nThe app file is a JSON array. Each object rejects unknown fields.\n\n```json\n[\n  {\n    \"id\": \"support-chat\",\n    \"name\": \"Support chat\",\n    \"mode\": \"chat\",\n    \"description\": \"Published customer-support application\",\n    \"api_key_file\": \"/run/secrets/dify-support-chat\"\n  }\n]\n```\n\n| Field | Required | Constraint |\n|---|---:|---|\n| `id` | Yes | Non-empty, not `knowledge`, no control characters, valid inside a capability ID |\n| `name` | Yes | Non-empty |\n| `mode` | Yes | `workflow`, `completion`, `chat`, `advanced-chat`, `agent-chat`, or `agent` |\n| `description` | No | Public discovery text |\n| `api_key_file` | Conditional | Required unless the legacy global app key is configured |\n\nApp IDs must be unique. The file may contain at most 1,000 descriptors and at\nmost 4 MiB of JSON. Those are parser ceilings, not a promise that such a set\nfits the global admitted-manifest capability limit.\n\nIf `AIP_DIFY_API_KEY_FILE` is set, every app must omit `api_key_file`. If the\nglobal key is absent, every app must name its own file. Mixed or missing sources\nfail startup.\n\n## Configure Knowledge credentials\n\nThe Knowledge file is also a JSON array with unknown fields denied.\n\n```json\n[\n  {\n    \"id\": \"main-workspace\",\n    \"name\": \"Main knowledge workspace\",\n    \"description\": \"Reviewed workspace Knowledge API boundary\",\n    \"api_key_file\": \"/run/secrets/dify-main-knowledge\"\n  }\n]\n```\n\n| Field | Required | Constraint |\n|---|---:|---|\n| `id` | Yes | Non-empty, no control characters, valid inside a capability ID |\n| `name` | Yes | Non-empty |\n| `description` | No | Public discovery text |\n| `api_key_file` | Yes | Owner-controlled workspace Knowledge API key |\n\nKnowledge IDs must be unique. The file shares the 4 MiB read bound and has a\n1,000-descriptor parser ceiling. Each descriptor publishes 46 capabilities, so\nmanifest validation normally constrains the practical count first.\n\nThe global application key never supplies a Knowledge credential.\n\n## Configure provider origin and keys\n\nThe Dify base URL must be an origin:\n\n- HTTPS is required except for explicit loopback HTTP;\n- credentials, path prefix, query, and fragment are rejected;\n- authenticated redirects are disabled;\n- provider connection establishment has a 10-second timeout.\n\nThe base URL does not identify a Dify source commit or image. Bind provider\nartifact identity and compatibility evidence outside this string.\n\nEvery API-key file is read as non-empty UTF-8 with a 16 KiB bound. Descriptor\nand configuration files may be public only when they contain no key material.\n\n## Set the response-size limit\n\n`AIP_DIFY_MAX_RESPONSE_BYTES` accepts an integer from `1` through `67108864`.\nOmission uses `8388608` bytes.\n\nThe connector checks declared content length and accumulated stream bytes. The\nsame active limit applies to blocking JSON, text, binary data before base64\nprojection, and the complete SSE response.\n\nIncreasing this setting does not increase the common native-envelope request\nlimit, JSON encoder bound, decoded upload limit, per-frame SSE limit, or event\ncount.\n\n## Apply relevant shared host settings\n\nThe global connector-host reference owns the complete matrix. These groups are\nrequired for Dify behavior.\n\n### Identity and route\n\n| Setting | Role |\n|---|---|\n| `AIP_CONNECTOR_HOST_PUBLIC_ENDPOINT` | Reachable native endpoint ending in `/aip/v1/messages` |\n| `AIP_CONNECTOR_HOST_TYPE_ID` | Admitted Dify connector type |\n| `AIP_CONNECTOR_HOST_VERSION_ID` | Immutable admitted version |\n| `AIP_CONNECTOR_HOST_INSTANCE_ID` | Logical descriptor and task-store boundary |\n| `AIP_CONNECTOR_HOST_REPLICA_ID` | Concrete process identity |\n| `AIP_CONNECTOR_HOST_TENANT_ID` | Verified tenant owned by the instance |\n| `AIP_CONNECTOR_HOST_MEMBERSHIP_ID` | Stable membership assertion |\n| `AIP_CONNECTOR_HOST_ARTIFACT_DIGEST` | Exact host artifact digest |\n| `AIP_CONNECTOR_HOST_SECRET_PROVIDER_REF` | Non-secret secret-provider reference |\n\nAn optional external-account ID and system must appear together. Dify can\ncontain several app and workspace identities, so deployment policy must define\nwhat that single external-account reference means.\n\n### Storage, signing, and lifecycle\n\n| Setting | Required or default |\n|---|---|\n| `AIP_CONNECTOR_HOST_BIND` | Default `0.0.0.0:8081` |\n| `AIP_CONNECTOR_HOST_DATABASE_URL_FILE` | Required owner-controlled PostgreSQL URL |\n| `AIP_CONNECTOR_HOST_SIGNING_SEED_FILE` | Required owner-controlled Ed25519 seed |\n| `AIP_CONNECTOR_HOST_CONTROL_ENDPOINT` | Required lifecycle endpoint |\n| `AIP_CONNECTOR_HOST_CONTROL_DID` or `_FILE` | Exactly one control-plane DID source |\n| `AIP_CONNECTOR_HOST_GATEWAY_PRINCIPAL_ID` | Required trusted gateway principal |\n| `AIP_CONNECTOR_HOST_GATEWAY_DID` or `_FILE` | Exactly one gateway DID source |\n| `AIP_CONNECTOR_HOST_TRUST_DOMAIN` | Required trust domain |\n| `AIP_CONNECTOR_HOST_TLS_CA_FILE` | Optional private-PKI root |\n| `AIP_CONNECTOR_HOST_MAX_IN_FLIGHT` | Default `32` |\n| `AIP_CONNECTOR_HOST_LEASE_TTL_MS` | Default `30000` |\n| `AIP_CONNECTOR_HOST_HEARTBEAT_MS` | Default `10000` |\n| `AIP_CONNECTOR_HOST_DRAIN_TIMEOUT_MS` | Default `30000` |\n| `AIP_CONNECTOR_HOST_HEALTH_TIMEOUT_MS` | Default `2000` |\n| `AIP_CONNECTOR_HOST_CONTROL_TIMEOUT_MS` | Default `5000` |\n\nShared credential ID, issuer, scope, revision, and revision-policy settings are\noptional as one complete unit. They fence route authorization and do not\nreplace Dify API-key files.\n\n### Stream callback\n\nStreaming publication can use the common fixed callback endpoint and its\nexplicit network policy:\n\n| Setting | Default |\n|---|---|\n| `AIP_CONNECTOR_HOST_CALLBACK_ENDPOINT` | None |\n| `AIP_CONNECTOR_HOST_CALLBACK_ALLOW_HTTP` | `false` |\n| `AIP_CONNECTOR_HOST_CALLBACK_ALLOW_PRIVATE` | `false` |\n\nConfigure callback behavior according to the selected gateway topology. The\nproduct configuration does not make a callback mandatory for non-streaming\noperations.\n\n## Use the effective limits\n\n| Boundary | Reviewed value |\n|---|---:|\n| Native AIP request body, common default | 4 MiB |\n| App or Knowledge descriptor file | 4 MiB |\n| App descriptors, parser ceiling | 1,000 |\n| Knowledge descriptors, parser ceiling | 1,000 |\n| API-key file | 16 KiB |\n| Provider JSON body encoder | 8 MiB |\n| Decoded upload file | 32 MiB |\n| Encoded upload field in capability schema | 48 MiB |\n| Query properties | 128 |\n| Values in one query array | 256 |\n| Body properties | 512 |\n| Rendered path parameter | 512 bytes |\n| End-user value | 256 bytes |\n| Provider response, default | 8 MiB |\n| Provider response, maximum | 64 MiB |\n| SSE frame | 1 MiB |\n| SSE events per response | 10,000 |\n| Concurrent credential health probes | 32 |\n\nThe effective request ceiling is the smallest applicable limit. The 8 MiB JSON\nencoder and 48 MiB encoded upload schema do not enlarge the common 4 MiB native\nenvelope limit.\n\n## Understand readiness\n\nProduct health checks every configured credential:\n\n| Credential | Probe |\n|---|---|\n| App | Authenticated `GET /v1/parameters` |\n| Knowledge | Authenticated `GET /v1/datasets?limit=1` |\n\nThe connector runs at most 32 checks concurrently and reports ready only after\nall succeed. Host readiness also requires durable storage, valid lease,\nnon-draining lifecycle state, and common host readiness.\n\nReadiness does not exercise app invocation, every mode-supported operation,\nmutation approval, stream termination, cancellation, binary response, upload,\nor provider compatibility beyond these reads.\n\n## Know startup and reload ownership\n\n| Value | Read |\n|---|---|\n| Provider origin | Startup |\n| App and Knowledge descriptor files | Startup |\n| Every Dify API-key file | Startup |\n| Response limit | Startup |\n| Common identity, topology, endpoints, and lifecycle limits | Startup |\n| Profile-state task-store scope | Constructed at startup from instance ID |\n| Credential-revision policy file | Startup, then before provider side effects |\n\nChange startup-owned values through a replacement replica and a new\nconfiguration or admission revision. Editing a file does not update the\nrunning manifest, key map, mode, task-store scope, or response limit.\n\n## Diagnose configuration failures\n\n| Failure | First decision |\n|---|---|\n| At least one app or knowledge credential is required | Supply a reviewed descriptor domain |\n| Invalid Dify base URL | Correct the origin; do not weaken scheme, credential, path, or redirect policy |\n| Unsupported app mode | Use one of the six exact mode strings |\n| App ID `knowledge` | Rename the app because that prefix belongs to Knowledge routing |\n| Duplicate descriptor ID | Make local routing identities unique |\n| Missing or ambiguous app key | Choose either per-app files or one intentional global source |\n| Invalid credential UTF-8 or size | Repair the owner-controlled file without printing it |\n| Descriptor count exceeds 1,000 | Split the deployment before manifest construction |\n| Manifest admission exceeds its capability limit | Reduce descriptors or split immutable instances |\n| Response bound is outside 1-64 MiB | Select a value inside the compiled range |\n| Health fails for one credential | Identify its descriptor and probe; do not rotate unrelated keys |\n\n## Related documentation\n\n- [Dify connector overview](../README.md)\n- [Authentication and credential scopes](../getting-started/authentication-and-credential-scopes.md)\n- [Connector host configuration](../../../reference/connector-host-configuration.md)\n- [Connector host lifecycle](../../../guides/connector-host-lifecycle.md)\n- [Environment variables](../../../reference/environment-variables.md)\n",
    "text": "Dify connector configuration\n\nThis reference describes the product settings accepted by aip-host-dify at\nthe reviewed source revision. A complete process combines these settings with\nthe shared connector-host identity, storage, routing, signing, lifecycle, and\noptional stream-callback settings.\n\nAll Dify product settings and key files are read at startup. Only the shared\nnon-secret credential-revision policy is re-read before provider side effects.\n\nConfiguration identity\n\n| Property | Value |\n\n| Binary | aip-host-dify |\n| AIP workspace version | 1.0.0 |\n| Reviewed AIP source | 97be86e9efedf07ecf1783b03800f683f107fb04 |\n| Connector ID | dify |\n| Connector profile | aip.connector.dify.v1 |\n| Pinned Dify source | f8d47616c15d0959f604f6a5e2e1d32d3108991b |\n| Frozen operation catalogue | 33 app operations and 46 Knowledge operations |\n\nEnvironment variables and flags contain non-secret values or file paths. API\nkeys, database credentials, and signing seeds belong in bounded\nowner-controlled files.\n\nDify-specific settings\n\n| Environment variable | Command-line flag | Required | Default | Meaning |\n\n| AIPDIFYBASEURL | --base-url | Yes | None | Fixed Dify origin shared by this host |\n| AIPDIFYAPIKEYFILE | --api-key-file | No | Per-app files | Legacy key shared intentionally by all configured apps |\n| AIPDIFYAPPSFILE | --apps-file | Conditional | Empty app set | JSON array of app descriptors |\n| AIPDIFYKNOWLEDGEFILE | --knowledge-file | Conditional | Empty Knowledge set | JSON array of Knowledge credentials |\n| AIPDIFYMAXRESPONSEBYTES | --max-response-bytes | No | 8388608 | Maximum blocking response or complete event stream |\n\nAt least one app or Knowledge descriptor is required. A host may serve only\napps, only Knowledge, or both domains.\n\nConfigure application descriptors\n\nThe app file is a JSON array. Each object rejects unknown fields.\n\n[\n  {\n    \"id\": \"support-chat\",\n    \"name\": \"Support chat\",\n    \"mode\": \"chat\",\n    \"description\": \"Published customer-support application\",\n    \"apikeyfile\": \"/run/secrets/dify-support-chat\"\n  }\n]\n\n| Field | Required | Constraint |\n\n| id | Yes | Non-empty, not knowledge, no control characters, valid inside a capability ID |\n| name | Yes | Non-empty |\n| mode | Yes | workflow, completion, chat, advanced-chat, agent-chat, or agent |\n| description | No | Public discovery text |\n| apikeyfile | Conditional | Required unless the legacy global app key is configured |\n\nApp IDs must be unique. The file may contain at most 1,000 descriptors and at\nmost 4 MiB of JSON. Those are parser ceilings, not a promise that such a set\nfits the global admitted-manifest capability limit.\n\nIf AIPDIFYAPIKEYFILE is set, every app must omit apikeyfile. If the\nglobal key is absent, every app must name its own file. Mixed or missing sources\nfail startup.\n\nConfigure Knowledge credentials\n\nThe Knowledge file is also a JSON array with unknown fields denied.\n\n[\n  {\n    \"id\": \"main-workspace\",\n    \"name\": \"Main knowledge workspace\",\n    \"description\": \"Reviewed workspace Knowledge API boundary\",\n    \"apikeyfile\": \"/run/secrets/dify-main-knowledge\"\n  }\n]\n\n| Field | Required | Constraint |\n\n| id | Yes | Non-empty, no control characters, valid inside a capability ID |\n| name | Yes | Non-empty |\n| description | No | Public discovery text |\n| apikeyfile | Yes | Owner-controlled workspace Knowledge API key |\n\nKnowledge IDs must be unique. The file shares the 4 MiB read bound and has a\n1,000-descriptor parser ceiling. Each descriptor publishes 46 capabilities, so\nmanifest validation normally constrains the practical count first.\n\nThe global application key never supplies a Knowledge credential.\n\nConfigure provider origin and keys\n\nThe Dify base URL must be an origin:\n• HTTPS is required except for explicit loopback HTTP;\n• credentials, path prefix, query, and fragment are rejected;\n• authenticated redirects are disabled;\n• provider connection establishment has a 10-second timeout.\n\nThe base URL does not identify a Dify source commit or image. Bind provider\nartifact identity and compatibility evidence outside this string.\n\nEvery API-key file is read as non-empty UTF-8 with a 16 KiB bound. Descriptor\nand configuration files may be public only when they contain no key material.\n\nSet the response-size limit\n\nAIPDIFYMAXRESPONSEBYTES accepts an integer from 1 through 67108864.\nOmission uses 8388608 bytes.\n\nThe connector checks declared content length and accumulated stream bytes. The\nsame active limit applies to blocking JSON, text, binary data before base64\nprojection, and the complete SSE response.\n\nIncreasing this setting does not increase the common native-envelope request\nlimit, JSON encoder bound, decoded upload limit, per-frame SSE limit, or event\ncount.\n\nApply relevant shared host settings\n\nThe global connector-host reference owns the complete matrix. These groups are\nrequired for Dify behavior.\n\nIdentity and route\n\n| Setting | Role |\n\n| AIPCONNECTORHOSTPUBLICENDPOINT | Reachable native endpoint ending in /aip/v1/messages |\n| AIPCONNECTORHOSTTYPEID | Admitted Dify connector type |\n| AIPCONNECTORHOSTVERSIONID | Immutable admitted version |\n| AIPCONNECTORHOSTINSTANCEID | Logical descriptor and task-store boundary |\n| AIPCONNECTORHOSTREPLICAID | Concrete process identity |\n| AIPCONNECTORHOSTTENANTID | Verified tenant owned by the instance |\n| AIPCONNECTORHOSTMEMBERSHIPID | Stable membership assertion |\n| AIPCONNECTORHOSTARTIFACTDIGEST | Exact host artifact digest |\n| AIPCONNECTORHOSTSECRETPROVIDERREF | Non-secret secret-provider reference |\n\nAn optional external-account ID and system must appear together. Dify can\ncontain several app and workspace identities, so deployment policy must define\nwhat that single external-account reference means.\n\nStorage, signing, and lifecycle\n\n| Setting | Required or default |\n\n| AIPCONNECTORHOSTBIND | Default 0.0.0.0:8081 |\n| AIPCONNECTORHOSTDATABASEURLFILE | Required owner-controlled PostgreSQL URL |\n| AIPCONNECTORHOSTSIGNINGSEEDFILE | Required owner-controlled Ed25519 seed |\n| AIPCONNECTORHOSTCONTROLENDPOINT | Required lifecycle endpoint |\n| AIPCONNECTORHOSTCONTROLDID or FILE | Exactly one control-plane DID source |\n| AIPCONNECTORHOSTGATEWAYPRINCIPALID | Required trusted gateway principal |\n| AIPCONNECTORHOSTGATEWAYDID or FILE | Exactly one gateway DID source |\n| AIPCONNECTORHOSTTRUSTDOMAIN | Required trust domain |\n| AIPCONNECTORHOSTTLSCAFILE | Optional private-PKI root |\n| AIPCONNECTORHOSTMAXINFLIGHT | Default 32 |\n| AIPCONNECTORHOSTLEASETTLMS | Default 30000 |\n| AIPCONNECTORHOSTHEARTBEATMS | Default 10000 |\n| AIPCONNECTORHOSTDRAINTIMEOUTMS | Default 30000 |\n| AIPCONNECTORHOSTHEALTHTIMEOUTMS | Default 2000 |\n| AIPCONNECTORHOSTCONTROLTIMEOUTMS | Default 5000 |\n\nShared credential ID, issuer, scope, revision, and revision-policy settings are\noptional as one complete unit. They fence route authorization and do not\nreplace Dify API-key files.\n\nStream callback\n\nStreaming publication can use the common fixed callback endpoint and its\nexplicit network policy:\n\n| Setting | Default |\n\n| AIPCONNECTORHOSTCALLBACKENDPOINT | None |\n| AIPCONNECTORHOSTCALLBACKALLOWHTTP | false |\n| AIPCONNECTORHOSTCALLBACKALLOWPRIVATE | false |\n\nConfigure callback behavior according to the selected gateway topology. The\nproduct configuration does not make a callback mandatory for non-streaming\noperations.\n\nUse the effective limits\n\n| Boundary | Reviewed value |\n\n| Native AIP request body, common default | 4 MiB |\n| App or Knowledge descriptor file | 4 MiB |\n| App descriptors, parser ceiling | 1,000 |\n| Knowledge descriptors, parser ceiling | 1,000 |\n| API-key file | 16 KiB |\n| Provider JSON body encoder | 8 MiB |\n| Decoded upload file | 32 MiB |\n| Encoded upload field in capability schema | 48 MiB |\n| Query properties | 128 |\n| Values in one query array | 256 |\n| Body properties | 512 |\n| Rendered path parameter | 512 bytes |\n| End-user value | 256 bytes |\n| Provider response, default | 8 MiB |\n| Provider response, maximum | 64 MiB |\n| SSE frame | 1 MiB |\n| SSE events per response | 10,000 |\n| Concurrent credential health probes | 32 |\n\nThe effective request ceiling is the smallest applicable limit. The 8 MiB JSON\nencoder and 48 MiB encoded upload schema do not enlarge the common 4 MiB native\nenvelope limit.\n\nUnderstand readiness\n\nProduct health checks every configured credential:\n\n| Credential | Probe |\n\n| App | Authenticated GET /v1/parameters |\n| Knowledge | Authenticated GET /v1/datasets?limit=1 |\n\nThe connector runs at most 32 checks concurrently and reports ready only after\nall succeed. Host readiness also requires durable storage, valid lease,\nnon-draining lifecycle state, and common host readiness.\n\nReadiness does not exercise app invocation, every mode-supported operation,\nmutation approval, stream termination, cancellation, binary response, upload,\nor provider compatibility beyond these reads.\n\nKnow startup and reload ownership\n\n| Value | Read |\n\n| Provider origin | Startup |\n| App and Knowledge descriptor files | Startup |\n| Every Dify API-key file | Startup |\n| Response limit | Startup |\n| Common identity, topology, endpoints, and lifecycle limits | Startup |\n| Profile-state task-store scope | Constructed at startup from instance ID |\n| Credential-revision policy file | Startup, then before provider side effects |\n\nChange startup-owned values through a replacement replica and a new\nconfiguration or admission revision. Editing a file does not update the\nrunning manifest, key map, mode, task-store scope, or response limit.\n\nDiagnose configuration failures\n\n| Failure | First decision |\n\n| At least one app or knowledge credential is required | Supply a reviewed descriptor domain |\n| Invalid Dify base URL | Correct the origin; do not weaken scheme, credential, path, or redirect policy |\n| Unsupported app mode | Use one of the six exact mode strings |\n| App ID knowledge | Rename the app because that prefix belongs to Knowledge routing |\n| Duplicate descriptor ID | Make local routing identities unique |\n| Missing or ambiguous app key | Choose either per-app files or one intentional global source |\n| Invalid credential UTF-8 or size | Repair the owner-controlled file without printing it |\n| Descriptor count exceeds 1,000 | Split the deployment before manifest construction |\n| Manifest admission exceeds its capability limit | Reduce descriptors or split immutable instances |\n| Response bound is outside 1-64 MiB | Select a value inside the compiled range |\n| Health fails for one credential | Identify its descriptor and probe; do not rotate unrelated keys |\n\nRelated documentation\n• Dify connector overview (../README.md)\n• Authentication and credential scopes (../getting-started/authentication-and-credential-scopes.md)\n• Connector host configuration (../../../reference/connector-host-configuration.md)\n• Connector host lifecycle (../../../guides/connector-host-lifecycle.md)\n• Environment variables (../../../reference/environment-variables.md)\n"
  },
  "integrity": {
    "algorithm": "sha256",
    "sourceDigest": "9cbbd544250ba4c4413aae73e7e83da46b1e588ecf59e992fe4bd06deda0bf6a"
  }
}