{"record":{"id":"839295c2b51f020a","repo":"BerriAI/litellm","slug":"cisco-ai-defense-api-key-is-required-set-cisco-a","errorCode":null,"errorMessage":"Cisco AI Defense API key is required. Set `CISCO_AI_DEFENSE_API_KEY` in the environment or pass `api_key` in the guardrail config.","messagePattern":"Cisco AI Defense API key is required\\. Set `CISCO_AI_DEFENSE_API_KEY` in the environment or pass `api_key` in the guardrail config\\.","errorType":"exception","errorClass":"CiscoAIDefenseGuardrailMissingSecrets","httpStatus":null,"severity":"critical","filePath":"litellm/proxy/guardrails/guardrail_hooks/cisco_ai_defense/cisco_ai_defense.py","lineNumber":151,"sourceCode":"        self,\n        guardrail_name: str | None = \"cisco-ai-defense\",\n        api_key: str | None = None,\n        api_base: str | None = None,\n        inspection_type: str | None = None,\n        inspect_path: str | None = None,\n        enabled_rules: Sequence[object] | None = None,\n        integration_profile_id: str | None = None,\n        integration_profile_version: str | None = None,\n        integration_tenant_id: str | None = None,\n        integration_type: str | None = None,\n        on_flagged_action: str | None = None,\n        fallback_on_error: str | None = None,\n        timeout: float | None = None,\n        **kwargs: Any,\n    ) -> None:\n        resolved_api_key: Final = api_key or os.environ.get(\"CISCO_AI_DEFENSE_API_KEY\")\n        if not resolved_api_key:\n            raise CiscoAIDefenseGuardrailMissingSecrets(\n                \"Cisco AI Defense API key is required. Set \"\n                \"`CISCO_AI_DEFENSE_API_KEY` in the environment or pass \"\n                \"`api_key` in the guardrail config.\"\n            )\n        self.api_key: str = resolved_api_key\n\n        self.api_base: str = (api_base or os.environ.get(\"CISCO_AI_DEFENSE_API_BASE\") or CISCO_DEFAULT_API_BASE).rstrip(\n            \"/\"\n        )\n\n        self.inspection_type: str = self._resolve_choice(\n            value=inspection_type,\n            env_var=\"CISCO_AI_DEFENSE_INSPECTION_TYPE\",\n            allowed=SUPPORTED_INSPECTION_TYPES,\n            default=DEFAULT_INSPECTION_TYPE,\n            setting_name=\"inspection_type\",\n        )\n","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_hooks/cisco_ai_defense/cisco_ai_defense.py#L133-L169","documentation":"CiscoAIDefenseGuardrailMissingSecrets is raised from the Cisco AI Defense guardrail constructor when both the api_key parameter and the CISCO_AI_DEFENSE_API_KEY environment variable are empty. The guardrail needs the key to authenticate every inspection request to the Cisco AI Defense API (header-based auth), so it refuses to initialize rather than skip scanning.","triggerScenarios":"Configuring a guardrail entry with guardrail: cisco_ai_defense but omitting api_key while CISCO_AI_DEFENSE_API_KEY is unset in the proxy's process environment; secret-manager references that resolve to None; key defined only in a .env file that the deployment method does not load.","commonSituations":"CI/staging environments missing the Cisco key; Docker Compose forgetting to pass the env through; the variable named with the older/different convention (e.g., CISCO_API_KEY) so it silently resolves empty.","solutions":["Export CISCO_AI_DEFENSE_API_KEY in the environment where litellm proxy runs and restart it.","Or set api_key: in the guardrail's litellm_params (supports os.environ/... and secret-manager references).","Confirm the exact name and that the value is non-empty in the running process (e.g., check the service's environment dump).","If using a secret manager, verify the reference resolves (litellm logs secret resolution failures at startup)."],"exampleFix":"# before\nguardrails:\n  - guardrail_name: cisco-ai-defense\n    litellm_params:\n      guardrail: cisco_ai_defense\n\n# after\n#   export CISCO_AI_DEFENSE_API_KEY=<key from Cisco AI Defense console>\nguardrails:\n  - guardrail_name: cisco-ai-defense\n    litellm_params:\n      guardrail: cisco_ai_defense\n      api_key: os.environ/CISCO_AI_DEFENSE_API_KEY","handlingStrategy":"validation","validationCode":"import os\nfrom litellm import get_secret_str\nif not (get_secret_str(\"CISCO_AI_DEFENSE_API_KEY\") or os.environ.get(\"CISCO_AI_DEFENSE_API_KEY\")):\n    raise SystemExit(\"CISCO_AI_DEFENSE_API_KEY missing — proxy cannot start cisco guardrail\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add a startup preflight that asserts every configured guardrail's required env keys are present.","Store keys in a secret manager and reference them from config so environments can't drift.","Name-seed alerts: any ValueError from guardrail init should page the on-call (proxy is down)."],"tags":["litellm","guardrails","cisco-ai-defense","api-key","configuration","startup"],"backgroundTag":"missing-api-key","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}