BerriAI/litellm · error · ValueError

PANW Prisma AIRS: api_key is required

Error message

PANW Prisma AIRS: api_key is required

What it means

initialize_panw_prisma_airs validates required settings before constructing PanwPrismaAirsHandler. Every scan request authenticates to Palo Alto Networks Prisma AIRS with an API key, so a guardrail config where litellm_params.api_key is missing or empty is rejected at init time with ValueError.

Source

Thrown at litellm/proxy/guardrails/guardrail_initializers.py:205

        api_base=litellm_params.api_base,
        user_id=litellm_params.lasso_user_id,
        conversation_id=litellm_params.lasso_conversation_id,
        mask=litellm_params.mask,
        event_hook=litellm_params.mode,
        default_on=litellm_params.default_on,
    )
    litellm.logging_callback_manager.add_litellm_callback(_lasso_callback)

    return _lasso_callback


def initialize_panw_prisma_airs(litellm_params, guardrail):
    from litellm.proxy.guardrails.guardrail_hooks.panw_prisma_airs import (
        PanwPrismaAirsHandler,
    )

    if not litellm_params.api_key:
        raise ValueError("PANW Prisma AIRS: api_key is required")
    if not litellm_params.profile_name:
        raise ValueError("PANW Prisma AIRS: profile_name is required")

    _panw_callback: Final = PanwPrismaAirsHandler(
        guardrail_name=guardrail.get("guardrail_name", "panw_prisma_airs"),  # Use .get() with default
        api_key=litellm_params.api_key,
        api_base=litellm_params.api_base or "https://service.api.aisecurity.paloaltonetworks.com/v1/scan/sync/request",
        profile_name=litellm_params.profile_name,
        default_on=litellm_params.default_on,
        mask_on_block=getattr(litellm_params, "mask_on_block", False),
        mask_request_content=getattr(litellm_params, "mask_request_content", False),
        mask_response_content=getattr(litellm_params, "mask_response_content", False),
        app_name=getattr(litellm_params, "app_name", None),
        fallback_on_error=getattr(litellm_params, "fallback_on_error", "block"),
        # `timeout` is now declared on BaseLitellmParams (Optional[float] = None),
        # so the attribute always exists. The Pydantic validator on LitellmParams
        # coerces strings to float, but None still means "use handler default" —
        # guard against float(None) here.

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Add api_key: os.environ/PANW_PRISMA_AIRS_API_KEY under litellm_params and set the env var for the proxy process
2. Verify the env var actually resolves in the proxy's environment (empty string fails this check)
3. When creating the guardrail through the admin API, include api_key inside litellm_params of the request body

Example fix

# before
litellm_params:
  guardrail: panw_prisma_airs
  profile_name: default

# after
litellm_params:
  guardrail: panw_prisma_airs
  api_key: os.environ/PANW_PRISMA_AIRS_API_KEY
  profile_name: default

# Validate guardrail config before starting the proxy
import os

required = {
    'api_key': os.getenv('PANW_PRISMA_AIRS_API_KEY'),
    'profile_name': os.getenv('PANW_PRISMA_AIRS_PROFILE_NAME'),
}
missing = [k for k, v in required.items() if not v]
if missing:
    raise SystemExit(f'panw_prisma_airs missing required litellm_params: {missing}')

def is_valid_panw_config(litellm_params: dict) -> bool:
    """True when the PANW Prisma AIRS guardrail has its required credentials."""
    return bool(litellm_params.get('api_key')) and bool(litellm_params.get('profile_name'))

When it happens

Trigger: A guardrails config entry with guardrail: panw_prisma_airs but no api_key under litellm_params, or an os.environ/ reference whose env var is unset (resolves falsy), or a guardrail created via the /guardrails API without api_key.

Common situations: Forgot the api_key field when copying a guardrail config template; used os.environ/PANW_API_KEY without exporting the var; env var set in the shell but not in the systemd/Docker unit running the proxy.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• PANW Prisma AIRS: profile_name is required
• DynamoAI API key is required. Set DYNAMOAI_API_KEY environme
• EnkryptAI API key is required. Set ENKRYPTAI_API_KEY environ
• MAVVRIK_API_KEY must be provided for Mavvrik FOCUS destinati
• Missing Cloudflare API Key - A call is being made to cloudfl

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/9da9e7e79a7fc0b6. Report an issue: GitHub.