BerriAI/litellm · error · BadRequestError

invalid_encrypted_content

invalid_encrypted_content

Error message

AzureException - {message}

This error occurs when load balancing Responses API across deployments with different API keys.
   Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations.

   Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment:

   router_settings:
     enable_pre_call_checks: true
     optional_pre_call_checks:
       - encrypted_content_affinity

   Learn more: https://docs.litellm.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing

What it means

Error "AzureException - {message} This error occurs when load balancing Responses API across deployments with different API keys. Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations. Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment: router_settings: enable_pre_call_checks: true optional_pre_call_checks: - encrypted_content_affinity Learn more: https://docs.litellm.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing" thrown in BerriAI/litellm.

Solutions

1. Enable 'encrypted_content_affinity' pre-call check so follow-up requests route to the deployment that created the encrypted content.
2. Use a single Azure deployment/API key per Responses API conversation.

When it happens

Trigger: Thrown at litellm/litellm_core_utils/exception_mapping_utils.py:1945 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/7688f95ce369a875. Report an issue: GitHub.

Appendix: source

Thrown at litellm/litellm_core_utils/exception_mapping_utils.py:1945

        raise AzureOpenAIExceptionMapping.create_content_policy_violation_error(
            message=message,
            model=model,
            extra_information=extra_information,
            original_exception=original_exception,
        )
    elif azure_error_code == "invalid_encrypted_content" or "could not be verified" in error_str:
        helpful_message: Final = (
            f"AzureException - {message}\n\n"
            "This error occurs when load balancing Responses API across deployments with different API keys.\n"
            "   Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations.\n\n"
            "   Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment:\n\n"
            "   router_settings:\n"
            "     enable_pre_call_checks: true\n"
            "     optional_pre_call_checks:\n"
            "       - encrypted_content_affinity\n\n"
            "   Learn more: https://docs.litellm.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing"
        )
        raise BadRequestError(
            message=helpful_message,
            llm_provider="azure",
            model=model,
            litellm_debug_info=extra_information,
            response=getattr(original_exception, "response", None),
            body=getattr(original_exception, "body", None),
        )
    elif "invalid_request_error" in error_str and getattr(original_exception, "status_code", None) in (None, 400):
        raise BadRequestError(
            message=f"AzureException BadRequestError - {message}",
            llm_provider="azure",
            model=model,
            litellm_debug_info=extra_information,
            response=getattr(original_exception, "response", None),
            body=getattr(original_exception, "body", None),
        )
    elif "The api_key client option must be set either by passing api_key to the client or by setting" in error_str:
        raise AuthenticationError(

View on GitHub (pinned to 77b7c6c40c)