BerriAI/litellm · error · LassoGuardrailAPIError

Failed to verify request safety with Lasso API: {error}

Error message

Failed to verify request safety with Lasso API: {error}

What it means

The generic fallback in _handle_api_error: it wraps every exception that is neither a httpx.TimeoutException nor a httpx.HTTPStatusError — connection refused, DNS resolution failures, TLS/SSL errors, JSON decoding problems — as well as ALL exceptions when httpx is not importable (HTTPX_AVAILABLE is False, so the specific isinstance branches are skipped). The original exception is appended after the colon and is the real diagnostic.

Source

Thrown at litellm/proxy/guardrails/guardrail_hooks/lasso/lasso.py:621

                "message_type": message_type,
                "error_type": type(error).__name__,
            },
        )

        # Handle specific error types if httpx is available
        if HTTPX_AVAILABLE:
            if isinstance(error, httpx.TimeoutException):
                raise LassoGuardrailAPIError("Lasso API timeout")
            elif isinstance(error, httpx.HTTPStatusError):
                if error.response.status_code == 401:
                    raise LassoGuardrailMissingSecrets("Invalid API key")
                elif error.response.status_code == 429:
                    raise LassoGuardrailAPIError("Lasso API rate limit exceeded")
                else:
                    raise LassoGuardrailAPIError(f"API error: {error.response.status_code}")

        # Generic error handling
        raise LassoGuardrailAPIError(f"Failed to verify request safety with Lasso API: {error}")

    def _log_masking_applied(
        self,
        message_type: Literal["PROMPT", "COMPLETION"],
        response: dict[str, Any],
    ) -> None:
        """Log masking application with structured context."""
        conversation_id: Final = getattr(self, "conversation_id", "unknown")
        verbose_proxy_logger.debug(
            "Lasso masking applied",
            extra={
                "guardrail_name": getattr(self, "guardrail_name", "unknown"),
                "message_type": message_type,
                "violations_count": len(response.get("findings", {})),
                "masked_fields": len(response.get("messages", [])),
                "conversation_id": conversation_id,
            },
        )

View on GitHub (pinned to 77b7c6c40c)

Solutions

  1. Read the inner exception text after the colon — it names the actual failure (connect error, DNS, SSL, ...).
  2. Test basic connectivity from the same host/container: curl -v against the Lasso API base URL.
  3. Install httpx (pip install 'litellm[proxy]' or pip install httpx) so HTTPX_AVAILABLE is true and specific error handling works.
  4. Fix HTTP_PROXY/HTTPS_PROXY/NO_PROXY settings or the CA bundle (REQUESTS_CA_BUNDLE/SSL_CERT_FILE) if a corporate proxy or TLS interception is involved.
Defensive patterns

Strategy: try-catch

Validate before calling

# Preflight: catch DNS/proxy/egress issues before the first guarded request
import httpx, os, socket

def lasso_egress_ok() -> tuple[bool, str]:
    base = os.environ.get("LASSO_API_BASE", "https://api.lasso.security")
    host = httpx.URL(base).host
    try:
        socket.getaddrinfo(host, 443)
    except socket.gaierror:
        return False, f"DNS cannot resolve {host}"
    try:
        httpx.head(base, timeout=5)
    except httpx.HTTPError as e:
        return False, f"egress to {base} failed: {type(e).__name__}: {e}"
    return True, "ok"

Type guard

from litellm.proxy.guardrails.guardrail_hooks.lasso.lasso import LassoGuardrailAPIError

def is_lasso_connectivity_error(err: Exception) -> bool:
    """Generic-branch error (not timeout, not a mapped status) — usually connect/DNS/SSL."""
    msg = str(err)
    return (
        isinstance(err, LassoGuardrailAPIError)
        and msg.startswith("Failed to verify request safety")
    )

Try / catch

from litellm.proxy.guardrails.guardrail_hooks.lasso.lasso import LassoGuardrailAPIError

try:
    result = await guardrail_hook(data)
except LassoGuardrailAPIError as e:
    if str(e).startswith("Failed to verify request safety"):
        # log the inner cause verbatim — it names connect/DNS/SSL/httpx-missing
        logger.error("lasso unreachable: %s", e)
        raise  # fix infra; retrying rarely helps until the cause is resolved
    raise

Prevention

When it happens

Trigger: httpx.ConnectError (connection refused), DNS failure resolving the Lasso host, SSL certificate verification failure behind a MITM/corporate proxy, or an environment where httpx is not installed so every error lands in this branch.

Common situations: Corporate HTTP(S)_PROXY env vars routing the guardrail's call through a dead or unreachable proxy; DNS misconfiguration in the container; a slim install missing the httpx dependency; self-signed TLS interceptors breaking the handshake to the Lasso endpoint.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/09d1bc1076efbe8a. Report an issue: GitHub.