odysseus-dev/odysseus · error · HTTPException

Rejected endpoint URL: {reason}

Error message

Rejected endpoint URL: {reason}

What it means

Error "Rejected endpoint URL: {reason}" thrown in odysseus-dev/odysseus.

Source

Thrown at routes/embedding_routes.py:272

    @router.post("/endpoint")
    def set_endpoint(url: str = Form(...), model: str = Form(""), api_key: str = Form("")):
        """Save a custom embedding endpoint URL."""
        url = url.strip()
        if not url:
            raise HTTPException(400, "URL is required")

        # SSRF hardening: validate the user-supplied URL before any outbound
        # request. Local-first means loopback/LAN endpoints are allowed by
        # default; non-HTTP(S) schemes and the cloud metadata range are always
        # rejected. Set EMBEDDING_BLOCK_PRIVATE_IPS=true for full lockdown.
        from src.url_safety import check_outbound_url
        ok, reason = check_outbound_url(
            url,
            block_private=os.getenv("EMBEDDING_BLOCK_PRIVATE_IPS", "false").lower() == "true",
        )
        if not ok:
            raise HTTPException(400, f"Rejected endpoint URL: {reason}")

        # Quick health check
        try:
            import httpx
            resp = httpx.post(
                url,
                json={"input": ["test"], "model": model or "test"},
                headers={"Authorization": f"Bearer {api_key}"} if api_key else {},
                timeout=10,
            )
            resp.raise_for_status()
        except Exception as e:
            raise HTTPException(400, f"Endpoint unreachable: {e}")

        # Persist and set in environment for immediate use
        data = {"url": url}
        if model:
            data["model"] = model

View on GitHub (pinned to f9235ebbf1)

Solutions

1. Use an http(s) URL pointing at an allowed host.
2. Fix the URL; internal or malformed addresses are rejected for safety.

When it happens

Trigger: Triggered when the corresponding server-side validation or runtime check at the recorded location rejects the request or operation and returns this error message to the caller.

Common situations: See trigger scenarios.

AI-assisted analysis of odysseus-dev/odysseus@f9235ebbf1 (2026-08-14). Data as JSON: /api/errors/d495471ba6d068b2. Report an issue: GitHub.