odysseus-dev/odysseus · error · HTTPException

Rejected endpoint URL: {reason}

Error message

Rejected endpoint URL: {reason}

What it means

Error "Rejected endpoint URL: {reason}" thrown in odysseus-dev/odysseus.

Source

Thrown at routes/gallery/gallery_routes.py:1277

        """Forward inpaint request. If the selected endpoint is OpenAI, re-shape
        the request for /v1/images/edits (multipart, inverted mask). Otherwise
        proxy through to a self-hosted diffusion server's /v1/images/inpaint."""
        import httpx
        user = require_privilege(request, "can_generate_images")
        body = await request.json()
        # Use endpoint from request body (editor dropdown) or fall back to DB lookup.
        # Store as requested_base to avoid carrying user input into the outbound request.
        requested_base = (body.pop("_endpoint", "") or "").rstrip("/")
        # SSRF hardening: validate a client-supplied endpoint before any
        # outbound request (mirrors routes/embedding_routes.py).
        if requested_base:
            from src.url_safety import check_outbound_url
            ok, reason = check_outbound_url(
                requested_base,
                block_private=os.getenv("IMAGE_BLOCK_PRIVATE_IPS", "false").lower() == "true",
            )
            if not ok:
                raise HTTPException(400, f"Rejected endpoint URL: {reason}")
        chosen_model = (body.pop("_model", "") or "").strip()
        api_key = None
        if not requested_base:
            db = SessionLocal()
            try:
                ep = _first_visible_image_endpoint(db, user)
                if not ep:
                    raise HTTPException(400, "No image generation endpoint configured. Serve a diffusion model via Cookbook first.")
                base = ep.base_url.rstrip("/")
                api_key = ep.api_key
            finally:
                db.close()
        else:
            # Resolve the client-supplied base to a registered visible endpoint.
            # Admins are not exempted — gallery proxy routes must use a DB row
            # so the outbound URL never depends directly on request-body input.
            db = SessionLocal()
            try:

View on GitHub (pinned to f9235ebbf1)

Solutions

1. Use an http(s) endpoint URL pointing at an allowed host.
2. Fix the endpoint URL; internal or malformed addresses are rejected.

When it happens

Trigger: Triggered when the corresponding server-side validation or runtime check at the recorded location rejects the request or operation and returns this error message to the caller.

Common situations: See trigger scenarios.

AI-assisted analysis of odysseus-dev/odysseus@f9235ebbf1 (2026-08-14). Data as JSON: /api/errors/587bc0a7bc7b21d1. Report an issue: GitHub.