BerriAI/litellm · error · LassoGuardrailAPIError

Failed to verify request safety with Lasso API

Error message

Failed to verify request safety with Lasso API: {error}

What it means

The generic fallback in _handle_api_error: it wraps every exception that is neither a httpx.TimeoutException nor a httpx.HTTPStatusError — connection refused, DNS resolution failures, TLS/SSL errors, JSON decoding problems — as well as ALL exceptions when httpx is not importable (HTTPX_AVAILABLE is False, so the specific isinstance branches are skipped). The original exception is appended after the colon and is the real diagnostic.

Solutions

  1. Read the inner exception text after the colon — it names the actual failure (connect error, DNS, SSL, ...).
  2. Test basic connectivity from the same host/container: curl -v against the Lasso API base URL.
  3. Install httpx (pip install 'litellm[proxy]' or pip install httpx) so HTTPX_AVAILABLE is true and specific error handling works.
  4. Fix HTTP_PROXY/HTTPS_PROXY/NO_PROXY settings or the CA bundle (REQUESTS_CA_BUNDLE/SSL_CERT_FILE) if a corporate proxy or TLS interception is involved.
Defensive patterns

Strategy: try-catch

Validate before calling

# Preflight: catch DNS/proxy/egress issues before the first guarded request
import httpx, os, socket

def lasso_egress_ok() -> tuple[bool, str]:
    base = os.environ.get("LASSO_API_BASE", "https://api.lasso.security")
    host = httpx.URL(base).host
    try:
        socket.getaddrinfo(host, 443)
    except socket.gaierror:
        return False, f"DNS cannot resolve {host}"
    try:
        httpx.head(base, timeout=5)
    except httpx.HTTPError as e:
        return False, f"egress to {base} failed: {type(e).__name__}: {e}"
    return True, "ok"

Type guard

from litellm.proxy.guardrails.guardrail_hooks.lasso.lasso import LassoGuardrailAPIError

def is_lasso_connectivity_error(err: Exception) -> bool:
    """Generic-branch error (not timeout, not a mapped status) — usually connect/DNS/SSL."""
    msg = str(err)
    return (
        isinstance(err, LassoGuardrailAPIError)
        and msg.startswith("Failed to verify request safety")
    )

Try / catch

from litellm.proxy.guardrails.guardrail_hooks.lasso.lasso import LassoGuardrailAPIError

try:
    result = await guardrail_hook(data)
except LassoGuardrailAPIError as e:
    if str(e).startswith("Failed to verify request safety"):
        # log the inner cause verbatim — it names connect/DNS/SSL/httpx-missing
        logger.error("lasso unreachable: %s", e)
        raise  # fix infra; retrying rarely helps until the cause is resolved
    raise

Prevention

When it happens

Trigger: httpx.ConnectError (connection refused), DNS failure resolving the Lasso host, SSL certificate verification failure behind a MITM/corporate proxy, or an environment where httpx is not installed so every error lands in this branch.

Common situations: Corporate HTTP(S)_PROXY env vars routing the guardrail's call through a dead or unreachable proxy; DNS misconfiguration in the container; a slim install missing the httpx dependency; self-signed TLS interceptors breaking the handshake to the Lasso endpoint.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/09d1bc1076efbe8a. Report an issue: GitHub.

Appendix: source

Thrown at litellm/proxy/guardrails/guardrail_hooks/lasso/lasso.py:621

                "message_type": message_type,
                "error_type": type(error).__name__,
            },
        )

        # Handle specific error types if httpx is available
        if HTTPX_AVAILABLE:
            if isinstance(error, httpx.TimeoutException):
                raise LassoGuardrailAPIError("Lasso API timeout")
            elif isinstance(error, httpx.HTTPStatusError):
                if error.response.status_code == 401:
                    raise LassoGuardrailMissingSecrets("Invalid API key")
                elif error.response.status_code == 429:
                    raise LassoGuardrailAPIError("Lasso API rate limit exceeded")
                else:
                    raise LassoGuardrailAPIError(f"API error: {error.response.status_code}")

        # Generic error handling
        raise LassoGuardrailAPIError(f"Failed to verify request safety with Lasso API: {error}")

    def _log_masking_applied(
        self,
        message_type: Literal["PROMPT", "COMPLETION"],
        response: dict[str, Any],
    ) -> None:
        """Log masking application with structured context."""
        conversation_id: Final = getattr(self, "conversation_id", "unknown")
        verbose_proxy_logger.debug(
            "Lasso masking applied",
            extra={
                "guardrail_name": getattr(self, "guardrail_name", "unknown"),
                "message_type": message_type,
                "violations_count": len(response.get("findings", {})),
                "masked_fields": len(response.get("messages", [])),
                "conversation_id": conversation_id,
            },
        )

View on GitHub (pinned to 77b7c6c40c)