JuliusBrussee/caveman · error
azure api-version is not on the allowlist
Error message
azure api-version %q is not on the allowlist
What it means
On the legacy deployment route the api-version value must appear in the allowlist (built-in list of dated versions plus preview/latest, overridable via CAVE_AZURE_API_VERSION_ALLOWLIST). The request carried an api-version that is not on that list, so the adapter refuses it to prevent unverified or deprecated versions.
Solutions
- Use an allowlisted api-version such as 2024-10-21, 2025-04-01-preview, or latest.
- If the version is required, set CAVE_AZURE_API_VERSION_ALLOWLIST (comma-separated) to include it.
- Upgrade the client SDK so it emits a current Azure OpenAI api-version.
- Check the CAVE_AZURE_API_VERSION_ALLOWLIST value for typos, stray spaces, or missing entries.
Example fix
// before export CAVE_AZURE_API_VERSION_ALLOWLIST=2025-04-01-preview GET /azure/openai/deployments/gpt-4o/chat/completions?api-version=2024-06-01 // after export CAVE_AZURE_API_VERSION_ALLOWLIST=2024-06-01,2025-04-01-preview GET /azure/openai/deployments/gpt-4o/chat/completions?api-version=2024-06-01
Defensive patterns
Strategy: validation
Validate before calling
// Go: check against the same allowlist the adapter uses before sending
func apiVersionAllowed(version string, allowlist []string) bool {
for _, v := range allowlist {
if v == version {
return true
}
}
return false
} Prevention
- Keep client SDK api-version and CAVE_AZURE_API_VERSION_ALLOWLIST in sync when you customize the allowlist.
- Upgrade SDKs proactively as Azure retires dated api-versions.
- Pin one allowlisted version (e.g. 2025-04-01-preview) in client configuration.
- When narrowing the allowlist, grep clients/configs for versions that would be dropped.
When it happens
Trigger: A request to /azure/openai/deployments/{deployment}/chat/completions?api-version=X where X is not in the effective allowlist — e.g. api-version=2023-05-15, or a value removed when the operator set a custom CAVE_AZURE_API_VERSION_ALLOWLIST.
Common situations: Azure retiring/renaming api-versions; an operator narrowing CAVE_AZURE_API_VERSION_ALLOWLIST without updating all clients; older SDKs pinned to retired versions; typos in the env var (spaces, wrong separator).
Related errors
- azure Foundry api-version
- azure request missing api-version
- azure legacy inference path
- bedrock model is not on the allowlist
- bedrock region is not on the allowlist
AI-assisted analysis of JuliusBrussee/caveman@3ee70a1026 (2026-09-20).
Data as JSON: /api/errors/30e290c84036ff8b.
Report an issue: GitHub.
Appendix: source
Thrown at proxy/providers/azureopenai/azure_routing.go:64
}
return nil
}
if !legacyChatCompletionsRoute(u.Path) {
return fmt.Errorf("azure legacy inference path %q is not supported", u.Path)
}
versions := u.Query()["api-version"]
if len(versions) > 1 {
return fmt.Errorf("azure request has duplicate api-version values")
}
version := ""
if len(versions) == 1 {
version = versions[0]
}
if version == "" {
return fmt.Errorf("azure request missing api-version")
}
if !apiVersionAllowed(version) {
return fmt.Errorf("azure api-version %q is not on the allowlist", version)
}
return nil
}
func foundryV1InferenceRoute(path string) bool {
path = strings.TrimPrefix(path, "/azure")
switch path {
case "/openai/v1/chat/completions", "/openai/v1/responses":
return true
default:
return false
}
}
func legacyChatCompletionsRoute(path string) bool {
path = strings.TrimPrefix(path, "/azure")
parts := strings.Split(strings.Trim(path, "/"), "/")
if len(parts) != 5 || parts[0] != "openai" || parts[1] != "deployments" ||View on GitHub (pinned to 3ee70a1026)