{"record":{"id":"9da9e7e79a7fc0b6","repo":"BerriAI/litellm","slug":"panw-prisma-airs-api-key-is-required","errorCode":null,"errorMessage":"PANW Prisma AIRS: api_key is required","messagePattern":"PANW Prisma AIRS: api_key is required","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/guardrails/guardrail_initializers.py","lineNumber":205,"sourceCode":"        api_base=litellm_params.api_base,\n        user_id=litellm_params.lasso_user_id,\n        conversation_id=litellm_params.lasso_conversation_id,\n        mask=litellm_params.mask,\n        event_hook=litellm_params.mode,\n        default_on=litellm_params.default_on,\n    )\n    litellm.logging_callback_manager.add_litellm_callback(_lasso_callback)\n\n    return _lasso_callback\n\n\ndef initialize_panw_prisma_airs(litellm_params, guardrail):\n    from litellm.proxy.guardrails.guardrail_hooks.panw_prisma_airs import (\n        PanwPrismaAirsHandler,\n    )\n\n    if not litellm_params.api_key:\n        raise ValueError(\"PANW Prisma AIRS: api_key is required\")\n    if not litellm_params.profile_name:\n        raise ValueError(\"PANW Prisma AIRS: profile_name is required\")\n\n    _panw_callback: Final = PanwPrismaAirsHandler(\n        guardrail_name=guardrail.get(\"guardrail_name\", \"panw_prisma_airs\"),  # Use .get() with default\n        api_key=litellm_params.api_key,\n        api_base=litellm_params.api_base or \"https://service.api.aisecurity.paloaltonetworks.com/v1/scan/sync/request\",\n        profile_name=litellm_params.profile_name,\n        default_on=litellm_params.default_on,\n        mask_on_block=getattr(litellm_params, \"mask_on_block\", False),\n        mask_request_content=getattr(litellm_params, \"mask_request_content\", False),\n        mask_response_content=getattr(litellm_params, \"mask_response_content\", False),\n        app_name=getattr(litellm_params, \"app_name\", None),\n        fallback_on_error=getattr(litellm_params, \"fallback_on_error\", \"block\"),\n        # `timeout` is now declared on BaseLitellmParams (Optional[float] = None),\n        # so the attribute always exists. The Pydantic validator on LitellmParams\n        # coerces strings to float, but None still means \"use handler default\" —\n        # guard against float(None) here.","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_initializers.py#L187-L223","documentation":"initialize_panw_prisma_airs validates required settings before constructing PanwPrismaAirsHandler. Every scan request authenticates to Palo Alto Networks Prisma AIRS with an API key, so a guardrail config where litellm_params.api_key is missing or empty is rejected at init time with ValueError.","triggerScenarios":"A guardrails config entry with guardrail: panw_prisma_airs but no api_key under litellm_params, or an os.environ/ reference whose env var is unset (resolves falsy), or a guardrail created via the /guardrails API without api_key.","commonSituations":"Forgot the api_key field when copying a guardrail config template; used os.environ/PANW_API_KEY without exporting the var; env var set in the shell but not in the systemd/Docker unit running the proxy.","solutions":["Add api_key: os.environ/PANW_PRISMA_AIRS_API_KEY under litellm_params and set the env var for the proxy process","Verify the env var actually resolves in the proxy's environment (empty string fails this check)","When creating the guardrail through the admin API, include api_key inside litellm_params of the request body"],"exampleFix":"# before\nlitellm_params:\n  guardrail: panw_prisma_airs\n  profile_name: default\n\n# after\nlitellm_params:\n  guardrail: panw_prisma_airs\n  api_key: os.environ/PANW_PRISMA_AIRS_API_KEY\n  profile_name: default","handlingStrategy":"validation","validationCode":"# Validate guardrail config before starting the proxy\nimport os\n\nrequired = {\n    'api_key': os.getenv('PANW_PRISMA_AIRS_API_KEY'),\n    'profile_name': os.getenv('PANW_PRISMA_AIRS_PROFILE_NAME'),\n}\nmissing = [k for k, v in required.items() if not v]\nif missing:\n    raise SystemExit(f'panw_prisma_airs missing required litellm_params: {missing}')","typeGuard":"def is_valid_panw_config(litellm_params: dict) -> bool:\n    \"\"\"True when the PANW Prisma AIRS guardrail has its required credentials.\"\"\"\n    return bool(litellm_params.get('api_key')) and bool(litellm_params.get('profile_name'))","tryCatchPattern":null,"preventionTips":["Template guardrail configs with all required keys and fail CI on missing ones","Use os.environ/ references and assert the env vars exist in the unit that runs the proxy","When creating guardrails via the admin API, validate the litellm_params payload client-side first"],"tags":["guardrail","panw","prisma-airs","api-key","config"],"backgroundTag":"missing-required-config","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}