BerriAI/litellm · error · CrowdStrikeAIDRGuardrailMissingSecrets

CrowdStrike AIDR API base URL is required. Set CS_AIDR_BASE_

Error message

CrowdStrike AIDR API base URL is required. Set CS_AIDR_BASE_URL environment variable or pass it in litellm_params.

What it means

Raised by CrowdStrikeAIDRHandler.__init__ when the CrowdStrike AIDR guardrail is instantiated without an API base URL: neither the api_base constructor argument (from litellm_params) nor the CS_AIDR_BASE_URL environment variable is set. The handler needs the guard endpoint URL up front, so the guardrail refuses to register at config-load time.

Source

Thrown at litellm/proxy/guardrails/guardrail_hooks/crowdstrike_aidr/crowdstrike_aidr.py:263

        Initializes the CrowdStrikeAIDRHandler.

        Args:
            guardrail_name (str): The name of the guardrail instance.
            api_key (str | None): The CrowdStrike AIDR API key. Reads from CS_AIDR_TOKEN env var if None.
            api_base (str | None): The CrowdStrike AIDR API base URL. Reads from CS_AIDR_BASE_URL env var if None.
            **kwargs: Additional arguments passed to the CustomGuardrail base class.
        """
        self.async_handler = get_async_httpx_client(llm_provider=httpxSpecialProvider.GuardrailCallback)

        self.api_key = api_key or os.environ.get("CS_AIDR_TOKEN")
        if not self.api_key:
            raise CrowdStrikeAIDRGuardrailMissingSecrets(
                "CrowdStrike AIDR API Key not found. Set CS_AIDR_TOKEN environment variable or pass it in litellm_params."
            )

        self.api_base = api_base or os.environ.get("CS_AIDR_BASE_URL")
        if not self.api_base:
            raise CrowdStrikeAIDRGuardrailMissingSecrets(
                "CrowdStrike AIDR API base URL is required. Set CS_AIDR_BASE_URL environment variable or pass it in litellm_params."
            )

        kwargs.setdefault("supported_event_hooks", list(self.get_supported_event_hooks()))
        # Pass relevant kwargs to the parent class
        super().__init__(guardrail_name=guardrail_name, **kwargs)
        verbose_proxy_logger.debug(
            "Initialized CrowdStrike AIDR Guardrail: name=%s, api_base=%s", guardrail_name, self.api_base
        )

    async def _call_crowdstrike_aidr_guard(
        self, payload: dict[str, Any], hook_name: str
    ) -> _GuardChatCompletionsResult:
        """
        Makes the API call to the CrowdStrike AIDR AI Guard endpoint.
        The function itself will raise an error if a response should be blocked,
        but otherwise will return a list of redacted messages that the caller
        should act on.

View on GitHub (pinned to 77b7c6c40c)

Solutions

Set CS_AIDR_BASE_URL to your CrowdStrike AIDR guard endpoint in the proxy environment and restart
Or add api_base under litellm_params in the guardrails entry: api_base: os.environ/CS_AIDR_BASE_URL
Confirm the value is a complete URL (scheme + host, per your CrowdStrike tenant) reachable from the proxy
Verify with printenv CS_AIDR_BASE_URL inside the same service context

Example fix

# before
guardrails:
  - guardrail_id: crowdstrike-aidr
    litellm_params:
      mode: guardrail_runs_before_llm_call
      api_key: os.environ/CS_AIDR_TOKEN

# after
# export CS_AIDR_BASE_URL=https://your-tenant.crowdstrike.cloud/api/aidr
guardrails:
  - guardrail_id: crowdstrike-aidr
    litellm_params:
      mode: guardrail_runs_before_llm_call
      api_key: os.environ/CS_AIDR_TOKEN
      api_base: os.environ/CS_AIDR_BASE_URL

Defensive patterns

Strategy: validation

Validate before calling

import os
from urllib.parse import urlparse

base = os.environ.get('CS_AIDR_BASE_URL')
if not base or not urlparse(base).scheme or not urlparse(base).netloc:
    raise RuntimeError('CS_AIDR_BASE_URL must be set to a full URL (scheme + host)')

Try / catch

from litellm.proxy.guardrails.guardrail_hooks.crowdstrike_aidr.crowdstrike_aidr import (
    CrowdStrikeAIDRGuardrailMissingSecrets,
)
try:
    handler = CrowdStrikeAIDRHandler(guardrail_name='cs-aidr', api_key=os.environ['CS_AIDR_TOKEN'])
except CrowdStrikeAIDRGuardrailMissingSecrets as e:
    raise SystemExit(f'guardrail config incomplete: {e}') from e

Prevention

Keep the base URL in an env var per environment (staging/prod tenants differ) rather than hard-coded YAML
Validate scheme+host with urlparse in the deploy preflight, not just presence
Pair the base URL with the token in the same secret store entry so they cannot skew

When it happens

Trigger: A crowdstrike-aidr guardrails entry in config.yaml that supplies api_key (or has CS_AIDR_TOKEN set) but omits api_base while CS_AIDR_BASE_URL is unset in the proxy process.

Common situations: Only the token was carried over from docs/examples (the base URL is easy to miss); base URL defined per-environment in staging but not in prod manifests; typo in the variable name.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/e25cbd9f25c8e6b3. Report an issue: GitHub.