The create_by_file and update-by-file endpoints in Dify v1.9.0 return "Invalid user account" for API keys prefixed with dataset-.

[zzzhhhlll]

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
• Please do not modify this template :) and fill in all the required fields.

Content

@app.route('/api/upload-document', methods=['POST'])
def upload_document():
dataset_id = request.form.get('dataset_id')
if 'file' not in request.files:
return jsonify({'error': 'xxx'}), 400
file = request.files['file']

url = f"http://127.0.0.1/v1/datasets/{dataset_id}/document/create-by-file"
headers = {
    "Authorization": f"Bearer {DIFY_DATASET_API_KEY}"
}
data = {
    "data": '{"indexing_technique":"high_quality","process_rule":{"mode":"automatic"}}'
}
files = {
    "file": (file.filename, file.read(), file.content_type)
}
try:
    response = requests.post(url, headers=headers, data=data, files=files)
    if response.ok:
        return jsonify(response.json())
    return jsonify({"error": "fail", "details": response.text}), response.status_code
except Exception as e:
    return jsonify({"error": str(e)}), 500          

response :{"code":"invalid_param","message":"Invalid user account","status":400}

[dosubot[bot]]

This is a confirmed bug in Dify v1.9.0 that was fixed the day after release in PR #26187.

Root cause: In v1.9.0, the DocumentAddByFileApi and DocumentUpdateByFileApi controllers had an incorrect validation check:

if not isinstance(current_user, EndUser):
    raise ValueError("Invalid user account")

The dataset API authentication decorator (validate_dataset_token) always sets an Account object as current_user (the tenant owner), never an EndUser [1]. So this check always fails, causing the "Invalid user account" error on every file upload request regardless of whether your API key is valid.

Solution: Upgrade to any version after v1.9.0 (e.g., v1.9.1+). The fix removed both isinstance checks from the file upload endpoints [2].

If you can't upgrade immediately, you can patch api/controllers/service_api/dataset/document.py by removing the EndUser import and both isinstance(current_user, EndUser) validation blocks.

Also note: the correct dataset API key prefix is ds-, not dataset- [3] — though that's separate from the bug you're hitting here.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.