{"record":{"id":"7688f95ce369a875","repo":"BerriAI/litellm","slug":"invalid-encrypted-content","errorCode":"invalid_encrypted_content","errorMessage":"AzureException - {message}\n\nThis error occurs when load balancing Responses API across deployments with different API keys.\n   Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations.\n\n   Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment:\n\n   router_settings:\n     enable_pre_call_checks: true\n     optional_pre_call_checks:\n       - encrypted_content_affinity\n\n   Learn more: https://docs.litellm.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing","messagePattern":"AzureException - \\{message\\}\n\nThis error occurs when load balancing Responses API across deployments with different API keys\\.\n   Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations\\.\n\n   Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment:\n\n   router_settings:\n     enable_pre_call_checks: true\n     optional_pre_call_checks:\n       - encrypted_content_affinity\n\n   Learn more: https://docs\\.litellm\\.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"error","filePath":"litellm/litellm_core_utils/exception_mapping_utils.py","lineNumber":1945,"sourceCode":"        raise AzureOpenAIExceptionMapping.create_content_policy_violation_error(\n            message=message,\n            model=model,\n            extra_information=extra_information,\n            original_exception=original_exception,\n        )\n    elif azure_error_code == \"invalid_encrypted_content\" or \"could not be verified\" in error_str:\n        helpful_message: Final = (\n            f\"AzureException - {message}\\n\\n\"\n            \"This error occurs when load balancing Responses API across deployments with different API keys.\\n\"\n            \"   Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations.\\n\\n\"\n            \"   Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment:\\n\\n\"\n            \"   router_settings:\\n\"\n            \"     enable_pre_call_checks: true\\n\"\n            \"     optional_pre_call_checks:\\n\"\n            \"       - encrypted_content_affinity\\n\\n\"\n            \"   Learn more: https://docs.litellm.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing\"\n        )\n        raise BadRequestError(\n            message=helpful_message,\n            llm_provider=\"azure\",\n            model=model,\n            litellm_debug_info=extra_information,\n            response=getattr(original_exception, \"response\", None),\n            body=getattr(original_exception, \"body\", None),\n        )\n    elif \"invalid_request_error\" in error_str and getattr(original_exception, \"status_code\", None) in (None, 400):\n        raise BadRequestError(\n            message=f\"AzureException BadRequestError - {message}\",\n            llm_provider=\"azure\",\n            model=model,\n            litellm_debug_info=extra_information,\n            response=getattr(original_exception, \"response\", None),\n            body=getattr(original_exception, \"body\", None),\n        )\n    elif \"The api_key client option must be set either by passing api_key to the client or by setting\" in error_str:\n        raise AuthenticationError(","sourceCodeStart":1927,"sourceCodeEnd":1963,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/litellm_core_utils/exception_mapping_utils.py#L1927-L1963","documentation":"litellm maps Azure 'invalid_encrypted_content' (or 'could not be verified' in the error) to litellm.BadRequestError, appending a detailed hint. Azure Responses API returns encrypted reasoning items; encrypted content is bound to the creating organization, so follow-up requests routed to a deployment with different keys cannot decrypt it.","triggerScenarios":"Load-balancing the Azure Responses API (responses(), previous_response_id or encrypted reasoning items in input) across deployments with different API keys/organizations: the first call creates encrypted content under org A, the retry/follow-up hits org B's deployment, Azure returns invalid_encrypted_content, and litellm raises BadRequestError with the affinity guidance.","commonSituations":"litellm Router/proxy setups with multiple Azure Responses API deployments on separate keys; failover mid-conversation; multi-region load balancing without sticky routing.","solutions":["Enable the built-in pre-call check exactly as the error says: router_settings: enable_pre_call_checks: true with optional_pre_call_checks: [encrypted_content_affinity]","Alternatively pin each conversation to one deployment (sticky sessions by session_id)","Or use only deployments sharing the same Azure organization/key for Responses API traffic","As a last resort disable returning encrypted content (azure reasoning options) so no encrypted items circulate","See https://docs.litellm.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing"],"exampleFix":"# before\nrouter_settings:\n  num_deployments: 3  # azure responses deployments, different keys -> 400 on follow-ups\n# after (proxy config.yaml)\nrouter_settings:\n  enable_pre_call_checks: true\n  optional_pre_call_checks:\n    - encrypted_content_affinity","handlingStrategy":"validation","validationCode":"# proxy config.yaml - gate before any Responses API traffic\nrouter_settings:\n  enable_pre_call_checks: true\n  optional_pre_call_checks:\n    - encrypted_content_affinity","typeGuard":"import litellm\n\ndef is_encrypted_content_affinity_error(e: Exception) -> bool:\n    return isinstance(e, litellm.BadRequestError) and ('could not be verified' in str(e) or 'encrypted_content' in str(e))","tryCatchPattern":"try:\n    resp = litellm.responses(model='azure/gpt-4o', input=items)\nexcept litellm.BadRequestError as e:\n    if 'could not be verified' in str(e):\n        pin_session_to_single_deployment(session_id)  # then replay once\n    raise","preventionTips":["Enable encrypted_content_affinity before turning on multi-deployment Responses API routing","Keep one org's keys per Responses API router pool","Pass session_id to the proxy so affinity has a keying basis"],"tags":["azure","responses-api","load-balancing","litellm"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}