{"record":{"id":"d495471ba6d068b2","repo":"odysseus-dev/odysseus","slug":"rejected-endpoint-url-reason","errorCode":null,"errorMessage":"Rejected endpoint URL: {reason}","messagePattern":"Rejected endpoint URL: (.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"routes/embedding_routes.py","lineNumber":272,"sourceCode":"\n    @router.post(\"/endpoint\")\n    def set_endpoint(url: str = Form(...), model: str = Form(\"\"), api_key: str = Form(\"\")):\n        \"\"\"Save a custom embedding endpoint URL.\"\"\"\n        url = url.strip()\n        if not url:\n            raise HTTPException(400, \"URL is required\")\n\n        # SSRF hardening: validate the user-supplied URL before any outbound\n        # request. Local-first means loopback/LAN endpoints are allowed by\n        # default; non-HTTP(S) schemes and the cloud metadata range are always\n        # rejected. Set EMBEDDING_BLOCK_PRIVATE_IPS=true for full lockdown.\n        from src.url_safety import check_outbound_url\n        ok, reason = check_outbound_url(\n            url,\n            block_private=os.getenv(\"EMBEDDING_BLOCK_PRIVATE_IPS\", \"false\").lower() == \"true\",\n        )\n        if not ok:\n            raise HTTPException(400, f\"Rejected endpoint URL: {reason}\")\n\n        # Quick health check\n        try:\n            import httpx\n            resp = httpx.post(\n                url,\n                json={\"input\": [\"test\"], \"model\": model or \"test\"},\n                headers={\"Authorization\": f\"Bearer {api_key}\"} if api_key else {},\n                timeout=10,\n            )\n            resp.raise_for_status()\n        except Exception as e:\n            raise HTTPException(400, f\"Endpoint unreachable: {e}\")\n\n        # Persist and set in environment for immediate use\n        data = {\"url\": url}\n        if model:\n            data[\"model\"] = model","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/odysseus-dev/odysseus/blob/f9235ebbf13f693a6fd29ce70b097f6ec83705bf/routes/embedding_routes.py#L254-L290","documentation":"Error \"Rejected endpoint URL: {reason}\" thrown in odysseus-dev/odysseus.","triggerScenarios":"Triggered when the corresponding server-side validation or runtime check at the recorded location rejects the request or operation and returns this error message to the caller.","commonSituations":"See trigger scenarios.","solutions":["Use an http(s) URL pointing at an allowed host.","Fix the URL; internal or malformed addresses are rejected for safety."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f9235ebbf13f693a6fd29ce70b097f6ec83705bf","analyzedAt":"2026-08-14T21:47:48.359Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}