BerriAI/litellm · error · GuardrailRaisedException

Sensitive data detected by

Error message

Sensitive data detected by {self.guardrail_name} (routing skipped: request has no session_id)

What it means

In the sensitive-data handling flow, when the guardrail is configured to reroute (should_route_on_sensitive_data() true) it calls raise_sensitive_data_route_exception; the ValueError raised for a missing session_id is caught here and converted into GuardrailRaisedException with this message, so the request is blocked outright rather than rerouted without a sticky session.

Solutions

Include metadata={'session_id': ...} or the session header on requests that may contain sensitive data
Catch GuardrailRaisedException client-side and retry once with a generated session_id
If sessionless traffic must pass, disable routing mode and rely on masking/blocking guardrail behavior

Example fix

# before
resp = await litellm.acompletion(...)  # GuardrailRaisedException: routing skipped: request has no session_id

# after
try:
    resp = await litellm.acompletion(..., metadata={'session_id': sid})
except GuardrailRaisedException:
    sid = str(uuid4())  # mint a session and retry
    resp = await litellm.acompletion(..., metadata={'session_id': sid})

Defensive patterns

Strategy: retry

Validate before calling

meta = data.get('metadata') or {}
if should_route and not meta.get('session_id'):
    data['metadata'] = {**meta, 'session_id': str(uuid4())}  # mint a session before the guardrail runs

Try / catch

try:
    resp = await litellm.acompletion(...)
except GuardrailRaisedException as e:
    if 'no session_id' in str(e):
        resp = await litellm.acompletion(..., metadata={'session_id': str(uuid4())})  # one retry with a session
    else:
        raise

Prevention

Always send session_id when sensitive-data routing is configured
Differentiate routing-skipped blocks from hard blocks by message content
Limit the retry to one attempt to avoid loops

When it happens

Trigger: sensitive_data_route_to_model configured, sensitive data detected, and the request lacks a session_id in metadata or headers — the inner ValueError from raise_sensitive_data_route_exception triggers this wrapper raise.

Common situations: Rolling out sensitive-data routing before clients send session ids; webhooks/one-shot jobs that have no conversation to bind; session id dropped by an intermediate proxy.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/9f4e27790c3a8de8. Report an issue: GitHub.

Appendix: source

Thrown at litellm/integrations/custom_guardrail.py:427

            request_data: The request data dictionary
            detection_info: Optional non-sensitive detection metadata. When routing,
                this is surfaced in request metadata and logs, so it must not contain
                the raw detected sensitive values.

        Raises:
            SensitiveDataRouteException: When configured to route and a session_id is present
            GuardrailRaisedException: When configured to block, or when routing is
                configured but no session_id is available
        """
        if self.should_route_on_sensitive_data():
            try:
                self.raise_sensitive_data_route_exception(
                    route_to_model=self.sensitive_data_route_to_model,
                    request_data=request_data,
                    detection_info=detection_info,
                )
            except ValueError:
                raise GuardrailRaisedException(
                    message=(
                        f"Sensitive data detected by {self.guardrail_name} (routing skipped: request has no session_id)"
                    ),
                    guardrail_name=self.guardrail_name,
                )
        else:
            raise GuardrailRaisedException(
                message=f"Sensitive data detected by {self.guardrail_name}",
                guardrail_name=self.guardrail_name,
            )

    @staticmethod
    def get_config_model() -> type["GuardrailConfigModel"] | None:
        """
        Returns the config model for the guardrail

        This is used to render the config model in the UI.
        """

View on GitHub (pinned to 77b7c6c40c)