{"record":{"id":"4170e5caa7b964d5","repo":"BerriAI/litellm","slug":"deepkeep-firewall-id-is-required-set-the-deepkee","errorCode":null,"errorMessage":"DeepKeep firewall_id is required. Set the `DEEPKEEP_FIREWALL_ID` environment variable or pass `deepkeep_firewall_id` in the guardrail config.","messagePattern":"DeepKeep firewall_id is required\\. Set the `DEEPKEEP_FIREWALL_ID` environment variable or pass `deepkeep_firewall_id` in the guardrail config\\.","errorType":"exception","errorClass":"DeepKeepGuardrailMissingSecrets","httpStatus":null,"severity":"error","filePath":"litellm/proxy/guardrails/guardrail_hooks/deepkeep/deepkeep.py","lineNumber":89,"sourceCode":"        unreachable_fallback: Literal[\"fail_closed\", \"fail_open\"] = \"fail_closed\",\n        extra_headers: Mapping[str, str] | list[str] | None = None,\n        **kwargs: Any,\n    ):\n        self.async_handler = get_async_httpx_client(llm_provider=httpxSpecialProvider.GuardrailCallback)\n\n        # API key\n        deepkeep_api_key: Final = api_key or os.environ.get(\"DEEPKEEP_API_KEY\")\n        if not deepkeep_api_key:\n            raise DeepKeepGuardrailMissingSecrets(\n                \"DeepKeep API key is required. Set the `DEEPKEEP_API_KEY` environment \"\n                \"variable or pass `api_key` in the guardrail config.\"\n            )\n        self.deepkeep_api_key: str = deepkeep_api_key\n\n        # Firewall ID\n        self.firewall_id = firewall_id or os.environ.get(\"DEEPKEEP_FIREWALL_ID\")\n        if not self.firewall_id:\n            raise DeepKeepGuardrailMissingSecrets(\n                \"DeepKeep firewall_id is required. Set the `DEEPKEEP_FIREWALL_ID` environment \"\n                \"variable or pass `deepkeep_firewall_id` in the guardrail config.\"\n            )\n\n        # API base URL\n        base_url = api_base or os.environ.get(\"DEEPKEEP_API_BASE\")\n        if not base_url:\n            raise DeepKeepGuardrailMissingSecrets(\n                \"DeepKeep API base URL is required. Set the `DEEPKEEP_API_BASE` environment \"\n                \"variable or pass `api_base` in the guardrail config.\"\n            )\n\n        # Normalize the API base – ensure it ends with the guardrail endpoint\n        base_url = base_url.rstrip(\"/\")\n        if base_url.endswith(_DEEPKEEP_GUARDRAIL_ENDPOINT.rstrip(\"/\")):\n            self.api_base = base_url\n        else:\n            self.api_base = f\"{base_url}{_DEEPKEEP_GUARDRAIL_ENDPOINT}\"","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_hooks/deepkeep/deepkeep.py#L71-L107","documentation":"DeepKeepGuardrailMissingSecrets raised by DeepKeepGuardrail.__init__ when no firewall_id is available: neither the firewall_id constructor argument (configurable via litellm_params as deepkeep_firewall_id) nor the DEEPKEEP_FIREWALL_ID environment variable is set. DeepKeep scopes every guard call to a specific firewall instance, so the guardrail refuses to register without it.","triggerScenarios":"A deepkeep guardrails entry that supplies api_key/api_base but omits deepkeep_firewall_id in litellm_params while DEEPKEEP_FIREWALL_ID is unset; note the config key name (deepkeep_firewall_id) differs from the env var name (DEEPKEEP_FIREWALL_ID), a common trip point.","commonSituations":"Docs example copied with only the API key filled in; firewall ID known in the DeepKeep console but never added to the deployment; using the wrong litellm_params key name (firewall_id vs deepkeep_firewall_id).","solutions":["Set DEEPKEEP_FIREWALL_ID in the proxy environment and restart","Or add deepkeep_firewall_id under litellm_params in the guardrails entry","Copy the firewall ID exactly from the DeepKeep console (no stray whitespace/quotes)","Confirm which key your litellm version reads from litellm_params (deepkeep_firewall_id) and match it"],"exampleFix":"# before\nguardrails:\n  - guardrail_id: deepkeep\n    litellm_params:\n      mode: guardrail_runs_before_llm_call\n      api_key: os.environ/DEEPKEEP_API_KEY\n\n# after\n# export DEEPKEEP_FIREWALL_ID=your-firewall-id\nguardrails:\n  - guardrail_id: deepkeep\n    litellm_params:\n      mode: guardrail_runs_before_llm_call\n      api_key: os.environ/DEEPKEEP_API_KEY\n      deepkeep_firewall_id: os.environ/DEEPKEEP_FIREWALL_ID","handlingStrategy":"validation","validationCode":"import os\n\nfw = os.environ.get('DEEPKEEP_FIREWALL_ID')\nif not fw or not fw.strip():\n    raise RuntimeError('DEEPKEEP_FIREWALL_ID missing/empty - copy the firewall id from the DeepKeep console')","typeGuard":null,"tryCatchPattern":"from litellm.proxy.guardrails.guardrail_hooks.deepkeep.deepkeep import DeepKeepGuardrailMissingSecrets\ntry:\n    guardrail = DeepKeepGuardrail(guardrail_name='deepkeep', api_key=os.environ['DEEPKEEP_API_KEY'])\nexcept DeepKeepGuardrailMissingSecrets as e:\n    raise SystemExit(f'guardrail config incomplete: {e}') from e","preventionTips":["Note the naming asymmetry: env var DEEPKEEP_FIREWALL_ID vs litellm_params key deepkeep_firewall_id - validate both spellings","Copy the firewall id verbatim from the DeepKeep console; strip whitespace when templating","Include the firewall id in the same preflight check as the API key"],"tags":["deepkeep","guardrails","config","environment-variables","litellm-proxy","startup-config"],"backgroundTag":"missing-required-config","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}