{"record":{"id":"649af98863d81430","repo":"BerriAI/litellm","slug":"litellm-managed-accessor-key-with-id-retrieve-o","errorCode":null,"errorMessage":"LiteLLM Managed {accessor_key} with id={retrieve_object_id} is invalid - does not contain encoded model_id.","messagePattern":"LiteLLM Managed (.+?) with id=(.+?) is invalid - does not contain encoded model_id\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"enterprise/litellm_enterprise/proxy/hooks/managed_files.py","lineNumber":693,"sourceCode":"\n            if accessor_key:\n                retrieve_object_id = cast(Optional[str], data.get(accessor_key))\n\n            potential_llm_object_id = (\n                _is_base64_encoded_unified_file_id(retrieve_object_id) if retrieve_object_id else False\n            )\n            if potential_llm_object_id and retrieve_object_id:\n                ## VALIDATE USER HAS ACCESS TO THE OBJECT ##\n                if not await self.can_user_call_unified_object_id(retrieve_object_id, user_api_key_dict):\n                    raise HTTPException(\n                        status_code=403,\n                        detail=f\"User {user_api_key_dict.user_id} does not have access to the object {retrieve_object_id}\",\n                    )\n\n                ## for managed batch id - get the model id\n                potential_model_id = get_model_id_from_unified_batch_id(potential_llm_object_id)\n                if potential_model_id is None:\n                    raise Exception(\n                        f\"LiteLLM Managed {accessor_key} with id={retrieve_object_id} is invalid - does not contain encoded model_id.\"\n                    )\n                data[\"model\"] = potential_model_id\n                data[accessor_key] = get_batch_id_from_unified_batch_id(potential_llm_object_id)\n        elif call_type == CallTypes.acreate_fine_tuning_job.value:\n            input_file_id = cast(Optional[str], data.get(\"training_file\"))\n            if input_file_id:\n                model_file_id_mapping = await self.get_model_file_id_mapping(\n                    [input_file_id], user_api_key_dict.parent_otel_span\n                )\n\n        return data\n\n    async def async_filter_deployments(\n        self,\n        model: str,\n        healthy_deployments: List,\n        messages: Optional[List[AllMessageValues]],","sourceCodeStart":675,"sourceCodeEnd":711,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/enterprise/litellm_enterprise/proxy/hooks/managed_files.py#L675-L711","documentation":"After access checks pass for a managed batch/object id, the hook decodes the unified id to extract the encoded model_id via get_model_id_from_unified_batch_id. If the base64 payload does not contain the expected model_id segment (corrupt, truncated, or hand-crafted id), a plain Exception is raised stating the managed object is invalid. This is a data-integrity failure of the unified id, not an auth failure.","triggerScenarios":"Passing a partially-copied or truncated base64 batch id (URL clipping, manual transcription); a unified id minted by an older proxy version with a different encoding scheme; client code that re-encodes or mangles ids between submit and retrieve.","commonSituations":"Ids stored in text columns that silently truncate; logging pipelines that strip '=' padding from base64; upgrading LiteLLM enterprise versions where the unified-id format changed; hand-modified ids in tests.","solutions":["Re-fetch the id from the creation response or /v1/batches list instead of copying it from logs or external storage","Ensure ids round-trip byte-for-byte (no trimming of base64 padding, no URL-unescaping twice)","If ids were created by an older proxy version, re-create the batch after upgrading so the id carries the current encoding","Check for middleware/gateway code that rewrites or truncates long header/query values containing the id"],"exampleFix":"# before: id copied from truncated log line\nawait client.batches.retrieve(\"ZmlsZSxsbG1fbW9kZWxfaWQ\" )  # missing segments\n\n# after: use the id exactly as returned\njob = await client.batches.create(...)\nawait client.batches.retrieve(job.id)","handlingStrategy":"validation","validationCode":"import base64\n\ndef unified_id_has_model_segment(unified_id: str) -> bool:\n    try:\n        decoded = base64.urlsafe_b64encode(unified_id.encode()).decode() if False else unified_id\n        # ids arrive base64-encoded; validate round-trip and marker presence\n        raw = base64.urlsafe_b64decode(unified_id + \"=\" * (-len(unified_id) % 4)).decode()\n        return \"llm_model_id,\" in raw or \"model_id\" in raw\n    except Exception:\n        return False\n\nassert unified_id_has_model_segment(batch_id), \"corrupt unified id; refetch it\"","typeGuard":"def is_wellformed_unified_batch_id(bid: str) -> bool:\n    import base64\n    try:\n        pad = bid + \"=\" * (-len(bid) % 4)\n        raw = base64.urlsafe_b64decode(pad).decode()\n        return \"model_id\" in raw and \";\" in raw\n    except Exception:\n        return False","tryCatchPattern":"try:\n    await client.batches.retrieve(batch_id)\nexcept Exception as e:\n    if \"does not contain encoded model_id\" in str(e):\n        # corrupt id: refetch from creation response, do not retry same id\n        raise ValueError(f\"corrupt unified id {batch_id}\") from e\n    raise","preventionTips":["Treat unified ids as opaque; never truncate, re-encode, or transcribe them manually","Store ids in columns sized for full base64 strings","After proxy upgrades, recreate batches whose ids predate the current format"],"tags":["batch","managed-files","data-corruption","unified-id"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}