{"record":{"id":"8fc43e40ccc2ac1d","repo":"docling-project/docling","slug":"connections-to-remote-services-is-only-allowed-whe","errorCode":null,"errorMessage":"Connections to remote services is only allowed when set explicitly. pipeline_options.enable_remote_services=True.","messagePattern":"Connections to remote services is only allowed when set explicitly\\. pipeline_options\\.enable_remote_services=True\\.","errorType":"exception","errorClass":"OperationNotAllowed","httpStatus":null,"severity":"error","filePath":"docling/models/inference_engines/vlm/api_openai_compatible_engine.py","lineNumber":64,"sourceCode":"        enable_remote_services: bool,\n        options: ApiVlmEngineOptions,\n        model_config: Optional[\"EngineModelConfig\"] = None,\n    ):\n        \"\"\"Initialize the API engine.\n\n        Args:\n            options: API-specific runtime options\n            model_config: Model configuration (repo_id, revision, extra_config)\n        \"\"\"\n        super().__init__(options, model_config=model_config)\n        self._initialized: bool = False\n        self.enable_remote_services = enable_remote_services\n        self.options: ApiVlmEngineOptions = options\n        self.model_api_params: dict[str, object] = {}\n        self.user_params: dict[str, object] = self.options.params.copy()\n\n        if not self.enable_remote_services:\n            raise OperationNotAllowed(\n                \"Connections to remote services is only allowed when set explicitly. \"\n                \"pipeline_options.enable_remote_services=True.\"\n            )\n\n        # Store model-spec api_params and user params separately so that the\n        # correct priority order can be applied in predict_batch:\n        #   model_spec defaults < request-level generation settings < user params\n        if model_config and \"api_params\" in model_config.extra_config:\n            self.model_api_params: dict = model_config.extra_config[\"api_params\"].copy()\n        else:\n            self.model_api_params = {}\n\n        # User-supplied params always win; if provided, model-spec defaults are\n        # not mixed in (prevents conflicts for vendor-specific keys like model_id).\n        self.user_params: dict = self.options.params.copy()\n\n    def initialize(self) -> None:\n        \"\"\"Initialize the API engine.","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/docling-project/docling/blob/61d76f1ff3f8428065465889f7b4577da7df704c/docling/models/inference_engines/vlm/api_openai_compatible_engine.py#L46-L82","documentation":"The OpenAI-compatible VLM engine constructor raises OperationNotAllowed unless enable_remote_services is True. Like the KServe object-detection engine, any Docling engine that calls out to a remote inference service requires the explicit pipeline_options.enable_remote_services opt-in, preventing accidental API calls (and cost/data leakage) to external endpoints.","triggerScenarios":"Configuring a VLM pipeline with the api_openai_compatible engine (e.g. a vLLM/OpenAI-compatible server URL) while pipeline_options.enable_remote_services is left False, then creating the pipeline.","commonSituations":"Adopting local-only Docling configs into a remote-LLM setup without adding the flag; assuming local vLLM endpoints are exempt (they are not — the flag applies regardless of host); CI configs templated without the flag.","solutions":["Set pipeline_options.enable_remote_services = True before building the converter/pipeline.","Confirm the target URL and API key are correct and intended — enabling the flag authorizes outbound calls to the OpenAI-compatible endpoint.","Keep the flag False for purely local engines (onnx/transformers) so remote calls remain impossible by default."],"exampleFix":"# before\npipeline_options = PdfPipelineOptions()\npipeline_options.vlm_options = VlmPipelineOptions(engine_options=ApiVlmEngineOptions(url=...))\n\n# after\npipeline_options = PdfPipelineOptions()\npipeline_options.enable_remote_services = True\npipeline_options.vlm_options = VlmPipelineOptions(engine_options=ApiVlmEngineOptions(url=...))","handlingStrategy":"validation","validationCode":"if isinstance(vlm_engine_opts, ApiVlmEngineOptions) and not pipeline_options.enable_remote_services:\n    raise SystemExit(\"Set pipeline_options.enable_remote_services=True to use an OpenAI-compatible VLM endpoint\")","typeGuard":"def is_remote_vlm_opts(o: object) -> \"TypeGuard[ApiVlmEngineOptions]\":\n    return isinstance(o, ApiVlmEngineOptions)","tryCatchPattern":"try:\n    converter = DocumentConverter(format_options=fmt_opts)\nexcept OperationNotAllowed as e:\n    raise ConfigurationError(f\"Remote VLM engine requires enable_remote_services=True: {e}\") from e","preventionTips":["Set enable_remote_services=True only in configs that intentionally target remote endpoints.","Fail fast at startup with an explicit check instead of during document conversion.","Keep local-only deployments on the flag's default False to guarantee no outbound calls."],"tags":["remote-services","configuration","vlm","security","openai-api"],"backgroundTag":null,"analyzedSha":"61d76f1ff3f8428065465889f7b4577da7df704c","analyzedAt":"2026-08-14T23:53:18.727Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}