user field: your own identifier for the end user a call acts on behalf of. Dify never authenticates it, so pick a stable value per person, such as an account ID, and send it consistently.
Dify starts tracking a new user the first time it appears, and one app key serves any number of end users.
What user Scopes
user controls what each call can see and do:
- Conversations: listing, history, renaming, and deletion all operate on that userâs conversations only.
-
Files: an upload belongs to the uploading user, and referencing it under a different
userfails. -
Stopping generation: the chat-family stop endpoints act only when
usermatches the one that started the reply. A mismatch is silently ignoredâthe call succeeds either way, so it isnât detectable from the response. Workflowâs Stop Workflow Task does not checkuser. -
Resuming runs: Stream Workflow Events returns a 404 when
userdoesnât match the runâs creator.
user per person across every call in a flowâupload, send, stop, and resume all check it.
API Users and Web App Users Stay Separate
Traffic through the API and Difyâs hosted web app keep separate identities: conversations your API users create never appear in the web app, and web app conversations never appear through the API.Resolve an End-User ID
Some responses carry an end-user ID instead of full details, such ascreated_by in the Upload File response. Get End User Info resolves it.