{"record":{"id":"8d6279a20cb81fd5","repo":"BerriAI/litellm","slug":"must-provide-file-file-url-or-file-id","errorCode":null,"errorMessage":"Must provide file, file_url, or file_id","messagePattern":"Must provide file, file_url, or file_id","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/rag_endpoints/endpoints.py","lineNumber":355,"sourceCode":"        file_obj = data.get(\"file\")\n        if file_obj and isinstance(file_obj, dict):\n            filename: Final = file_obj.get(\"filename\")\n            content_b64: Final = file_obj.get(\"content\")\n            content_type = file_obj.get(\"content_type\", \"application/octet-stream\")\n\n            if filename and content_b64:\n                try:\n                    file_content = base64.b64decode(content_b64)\n                    file_data = (filename, file_content, content_type)\n                except Exception as e:\n                    raise HTTPException(\n                        status_code=400,\n                        detail={\"error\": f\"Invalid base64 content: {e}\"},\n                    )\n\n    # Validate\n    if file_data is None and file_url is None and file_id is None:\n        raise HTTPException(\n            status_code=400,\n            detail={\"error\": \"Must provide file, file_url, or file_id\"},\n        )\n\n    if \"vector_store\" not in ingest_options:\n        raise HTTPException(\n            status_code=400,\n            detail={\"error\": \"ingest_options must contain 'vector_store' configuration\"},\n        )\n\n    # Credential fields must come from server configuration, not user requests.\n    # Accepting user-supplied credentials (e.g. vertex_credentials with\n    # type=external_account + credential_source.file=/proc/1/environ) allows\n    # any authenticated user to exfiltrate host secrets via SSRF through\n    # google-auth's identity_pool credential refresh.\n    # api_base is also blocked: a user-controlled base URL causes the server\n    # to send its configured provider credentials to an attacker endpoint.\n    _BLOCKED_VECTOR_STORE_CREDENTIAL_PARAMS: Final = {","sourceCodeStart":337,"sourceCodeEnd":373,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/rag_endpoints/endpoints.py#L337-L373","documentation":"RAG ingest request validation: after parsing the JSON body, none of the three accepted file sources is present — no inline 'file' object, no 'file_url', and no 'file_id' — so there is nothing to ingest; rejected with 400.","triggerScenarios":"Thrown at litellm/proxy/rag_endpoints/endpoints.py:355 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide exactly one of file (base64), file_url, or file_id in the ingest request."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}