{"record":{"id":"242cd3d39eeb4334","repo":"BerriAI/litellm","slug":"field-cannot-be-set-in-ingest-options-vector-s","errorCode":null,"errorMessage":"'{field}' cannot be set in ingest_options.vector_store. Credentials must be configured server-side.","messagePattern":"'(.+?)' cannot be set in ingest_options\\.vector_store\\. Credentials must be configured server-side\\.","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/rag_endpoints/endpoints.py","lineNumber":393,"sourceCode":"        \"vertex_ai_credentials\",\n        \"aws_access_key_id\",\n        \"aws_secret_access_key\",\n        \"aws_session_token\",\n        \"aws_web_identity_token\",\n        \"aws_role_name\",\n        \"aws_session_name\",\n        \"aws_profile_name\",\n        \"aws_sts_endpoint\",\n        \"aws_external_id\",\n        \"azure_ad_token\",\n        \"api_key\",\n        \"api_base\",\n    }\n    vector_store_opts: Final[object] = ingest_options.get(\"vector_store\", {})\n    if isinstance(vector_store_opts, dict):\n        for field in _BLOCKED_VECTOR_STORE_CREDENTIAL_PARAMS:\n            if field in vector_store_opts:\n                raise HTTPException(\n                    status_code=400,\n                    detail={\n                        \"error\": f\"'{field}' cannot be set in ingest_options.vector_store. \"\n                        \"Credentials must be configured server-side.\"\n                    },\n                )\n\n    return ingest_options, file_data, file_url, file_id\n\n\n@router.post(\n    \"/v1/rag/ingest\",\n    dependencies=[Depends(user_api_key_auth)],\n    response_class=ORJSONResponse,\n    tags=[\"rag\"],\n)\n@router.post(\n    \"/rag/ingest\",","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/rag_endpoints/endpoints.py#L375-L411","documentation":"Security guard in RAG ingest: a credential-style field (api_key, api_base, aws_*, azure tokens, etc.) was found in ingest_options.vector_store. Client requests may not supply provider credentials; they must be configured server-side, so the request is rejected naming the offending field.","triggerScenarios":"Thrown at litellm/proxy/rag_endpoints/endpoints.py:393 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove credential fields from ingest_options.vector_store; configure vector store credentials server-side in config.yaml."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}