agenta 0.62.3__tar.gz → 0.64.1__tar.gz

{agenta-0.62.3 → agenta-0.64.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agenta
-Version: 0.62.3
+Version: 0.64.1
 Summary: The SDK for agenta is an open-source LLMOps platform.
 Keywords: LLMOps,LLM,evaluation,prompt engineering
 Author: Mahmoud Mabrouk
@@ -16,7 +16,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Topic :: Software Development :: Libraries
 Requires-Dist: decorator (>=5.2.1,<6.0.0)
-Requires-Dist: fastapi (>=0.116.0,<0.117.0)
+Requires-Dist: fastapi (>=0.122.0,<0.123.0)
 Requires-Dist: google-auth (>=2.23,<3)
 Requires-Dist: h11 (>=0.16.0,<0.17.0)
 Requires-Dist: httpx (>=0.28.0,<0.29.0)
@@ -34,7 +34,6 @@ Requires-Dist: python-dotenv (>=1.0.0,<2.0.0)
 Requires-Dist: python-jsonpath (>=2.0.0,<3.0.0)
 Requires-Dist: pyyaml (>=6.0.2,<7.0.0)
 Requires-Dist: restrictedpython (>=8.0,<9.0) ; python_version >= "3.11" and python_version < "3.14"
-Requires-Dist: starlette (>=0.47.0,<0.48.0)
 Requires-Dist: structlog (>=25.2.0,<26.0.0)
 Requires-Dist: tiktoken (==0.11.0)
 Requires-Dist: toml (>=0.10.2,<0.11.0)
@@ -61,9 +60,9 @@ Description-Content-Type: text/markdown
       <div align="center" >
         <a href="https://cloud.agenta.ai?utm_source=github&utm_medium=referral&utm_campaign=readme">
           <picture >
-        <source media="(prefers-color-scheme: dark)" srcset="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/9a4fde42-c96c-4ec2-b8d1-c8c0e3851a00/large"  >
-        <source media="(prefers-color-scheme: light)" srcset="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/98140352-14c0-4db1-bafb-a1e8d271d500/large"  >
-        <img alt="Shows the logo of agenta" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/98140352-14c0-4db1-bafb-a1e8d271d500/large" >
+        <source media="(prefers-color-scheme: dark)" srcset="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/6fa19a9d-9785-4acf-5d08-e81b1e38b100/large"  >
+        <source media="(prefers-color-scheme: light)" srcset="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/6fa19a9d-9785-4acf-5d08-e81b1e38b100/large"  >
+        <img alt="Shows the logo of agenta" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/6fa19a9d-9785-4acf-5d08-e81b1e38b100/large" >
           </picture>
         </a>
     </div>
@@ -155,10 +154,10 @@ Get visibility into your LLM applications in production.
 
 ## 📸 Screenshots
 
-<img alt="Playground" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/e7d16967-d564-4148-3615-03bfe2a29d00/large" />
-<img alt="Prompt Management" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/b4210a13-b41e-4dfd-d383-4286fb011e00/large" />
-<img alt="Evaluation" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/4b1c62b9-ff6e-4bd1-4c8d-de59b8485e00/large" />
-<img  alt="Observability" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/5c764759-e525-499e-544a-1077c45e9600/large" />
+<img alt="Playground" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/a4f67ac4-1acc-40c6-7a1a-5616eee7bb00/large" />
+<img alt="Prompt Management" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/65f697d0-3221-4e3c-7232-f350b1976a00/large" />
+<img alt="Evaluation" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/19b5b77e-6945-4419-15b9-cfea197e1300/large" />
+<img  alt="Observability" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/efc8a24c-2a2a-427c-f285-7d8b41200700/large" />
 
 ## 🚀 Getting Started 
 

{agenta-0.62.3 → agenta-0.64.1}/README.md

@@ -16,9 +16,9 @@
       <div align="center" >
         <a href="https://cloud.agenta.ai?utm_source=github&utm_medium=referral&utm_campaign=readme">
           <picture >
-        <source media="(prefers-color-scheme: dark)" srcset="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/9a4fde42-c96c-4ec2-b8d1-c8c0e3851a00/large"  >
-        <source media="(prefers-color-scheme: light)" srcset="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/98140352-14c0-4db1-bafb-a1e8d271d500/large"  >
-        <img alt="Shows the logo of agenta" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/98140352-14c0-4db1-bafb-a1e8d271d500/large" >
+        <source media="(prefers-color-scheme: dark)" srcset="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/6fa19a9d-9785-4acf-5d08-e81b1e38b100/large"  >
+        <source media="(prefers-color-scheme: light)" srcset="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/6fa19a9d-9785-4acf-5d08-e81b1e38b100/large"  >
+        <img alt="Shows the logo of agenta" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/6fa19a9d-9785-4acf-5d08-e81b1e38b100/large" >
           </picture>
         </a>
     </div>
@@ -110,10 +110,10 @@ Get visibility into your LLM applications in production.
 
 ## 📸 Screenshots
 
-<img alt="Playground" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/e7d16967-d564-4148-3615-03bfe2a29d00/large" />
-<img alt="Prompt Management" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/b4210a13-b41e-4dfd-d383-4286fb011e00/large" />
-<img alt="Evaluation" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/4b1c62b9-ff6e-4bd1-4c8d-de59b8485e00/large" />
-<img  alt="Observability" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/5c764759-e525-499e-544a-1077c45e9600/large" />
+<img alt="Playground" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/a4f67ac4-1acc-40c6-7a1a-5616eee7bb00/large" />
+<img alt="Prompt Management" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/65f697d0-3221-4e3c-7232-f350b1976a00/large" />
+<img alt="Evaluation" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/19b5b77e-6945-4419-15b9-cfea197e1300/large" />
+<img  alt="Observability" src="https://imagedelivery.net/UNvjPBCIZFONpkVPQTxVuA/efc8a24c-2a2a-427c-f285-7d8b41200700/large" />
 
 ## 🚀 Getting Started 
 

{agenta-0.62.3 → agenta-0.64.1}/agenta/client/backend/types/projects_response.py

@@ -13,6 +13,7 @@ class ProjectsResponse(UniversalBaseModel):
     workspace_name: typing.Optional[str] = None
     project_id: str
     project_name: str
+    is_default_project: bool = False
     user_role: typing.Optional[str] = None
     is_demo: typing.Optional[bool] = None
 

{agenta-0.62.3 → agenta-0.64.1}/agenta/sdk/agenta_init.py

@@ -85,28 +85,30 @@ class AgentaSingleton:
 
         _api_url = (
             api_url
+            or getenv("AGENTA_API_INTERNAL_URL")
             or getenv("AGENTA_API_URL")
             or config.get("api_url")
             or None  # NO FALLBACK
         )
 
         if _api_url:
+            _api_url = parse_url(url=_api_url)
             _host = _api_url.rsplit("/api", 1)[0]
-
-        if _host and not _api_url:
+        elif _host:
+            _host = parse_url(url=_host)
             _api_url = _host + "/api"
 
         try:
-            assert _host and isinstance(_host, str), (
-                "Host is required. Please provide a valid host or set AGENTA_HOST environment variable."
+            assert _api_url and isinstance(_api_url, str), (
+                "API URL is required. Please provide a valid API URL or set AGENTA_API_URL environment variable."
             )
-            self.host = parse_url(url=_host)
-            self.api_url = self.host + "/api"
+            self.host = _host
+            self.api_url = _api_url
         except AssertionError as e:
             log.error(str(e))
             raise
         except Exception as e:
-            log.error(f"Failed to parse host URL '{_host}': {e}")
+            log.error(f"Failed to parse API URL '{_api_url}': {e}")
             raise
 
         self.api_key = (

{agenta-0.62.3 → agenta-0.64.1}/agenta/sdk/assets.py

@@ -27,6 +27,7 @@ supported_llm_models = {
         "deepinfra/mistralai/Mistral-7B-Instruct-v0.1",
     ],
     "gemini": [
+        "gemini/gemini-3-pro-preview",
         "gemini/gemini-2.5-pro",
         "gemini/gemini-2.5-pro-preview-05-06",
         "gemini/gemini-2.5-flash",

{agenta-0.62.3 → agenta-0.64.1}/agenta/sdk/decorators/routing.py

@@ -223,10 +223,12 @@ class route:
 
         async def invoke_endpoint(req: Request, request: WorkflowServiceRequest):
             credentials = req.state.auth.get("credentials")
+            secrets = req.state.auth.get("secrets")
 
             try:
                 response = await workflow.invoke(
                     request=request,
+                    secrets=secrets,
                     credentials=credentials,
                 )
 

{agenta-0.62.3 → agenta-0.64.1}/agenta/sdk/evaluations/runs.py

@@ -124,11 +124,10 @@ async def aclose(
 async def aurl(
     *,
     run_id: UUID,
-) -> str:
+) -> Optional[str]:
     response = authed_api()(
         method="GET",
-        endpoint=f"/projects",
-        params={"scope": "project"},
+        endpoint=f"/projects/current",
     )
 
     try:
@@ -137,10 +136,10 @@ async def aurl(
         print(response.text)
         raise
 
-    if len(response.json()) != 1:
-        return None
+    project_info = response.json()
 
-    project_info = response.json()[0]
+    if not project_info:
+        return None
 
     workspace_id = project_info.get("workspace_id")
     project_id = project_info.get("project_id")

{agenta-0.62.3 → agenta-0.64.1}/agenta/sdk/litellm/litellm.py

@@ -193,6 +193,9 @@ def litellm_handler():
 
             span.end()
 
+            # Clean up span from dictionary to prevent memory leak
+            del self.span[litellm_call_id]
+
         def log_failure_event(
             self,
             kwargs,
@@ -221,6 +224,9 @@ def litellm_handler():
 
             span.end()
 
+            # Clean up span from dictionary to prevent memory leak
+            del self.span[litellm_call_id]
+
         async def async_log_stream_event(
             self,
             kwargs,
@@ -321,6 +327,9 @@ def litellm_handler():
 
             span.end()
 
+            # Clean up span from dictionary to prevent memory leak
+            del self.span[litellm_call_id]
+
         async def async_log_failure_event(
             self,
             kwargs,
@@ -349,4 +358,7 @@ def litellm_handler():
 
             span.end()
 
+            # Clean up span from dictionary to prevent memory leak
+            del self.span[litellm_call_id]
+
     return LitellmHandler()

{agenta-0.62.3 → agenta-0.64.1}/agenta/sdk/managers/secrets.py

@@ -156,17 +156,17 @@ class SecretsManager:
         # STEP 1: get vault secrets from route context and transform it
         secrets = SecretsManager.get_from_route()
         if not secrets:
-            return []
+            return None
 
         # STEP 1b: Parse secrets into usable format
         secrets = SecretsManager._parse_secrets(secrets=secrets)
 
         # STEP 2: check model exists in supported standard models
-        provider = _standard_providers.get(model)
+        provider = _standard_providers.get(request_provider_model)
         if not provider:
             # check and get provider kind if model exists in custom provider models
             provider = SecretsManager._custom_providers_get(
-                model=model,
+                model=request_provider_model,
                 secrets=secrets,
             )
 
@@ -175,16 +175,19 @@ class SecretsManager:
             return None
 
         # STEP 2c: get litellm compatible model
-        provider_slug = SecretsManager._custom_provider_slug_get(
-            model=model, secrets=secrets
+        request_provider_slug = (
+            SecretsManager._custom_provider_slug_get(
+                model=request_provider_model, secrets=secrets
+            )
+            or ""
         )
-        model = SecretsManager._get_compatible_model(
-            model=model, provider_slug=provider_slug
+        compatible_provider_model = SecretsManager._get_compatible_model(
+            model=request_provider_model, provider_slug=request_provider_slug
         )
 
         # STEP 3: initialize provider settings and simplify provider name
-        provider_settings = {"model": model}
-        provider_name = re.sub(
+        provider_settings = dict(model=compatible_provider_model)
+        request_provider_kind = re.sub(
             r"[\s-]+", "", provider.lower()
         )  # normalizing other special characters too (azure-openai)
 
@@ -196,25 +199,35 @@ class SecretsManager:
             # i). Extract API key if present
             # (for standard models -- openai/anthropic/gemini, etc)
             if secret.get("kind") == "provider_key":
-                provider_kind = secret_data.get("kind", "")
+                secret_provider_kind = secret_data.get("kind", "")
 
-                if provider_kind == provider_name:
+                if request_provider_kind == secret_provider_kind:
                     if "key" in provider_info:
                         provider_settings["api_key"] = provider_info["key"]
                 continue
 
             # ii). Extract Credentials if present
-            # (for custom providers -- aws bedrock/sagemaker, vertexai, etc)
+            # (for custom providers -- aws bedrock/sagemaker, vertex_ai, etc)
             elif secret.get("kind") == "custom_provider":
-                provider_kind = provider_info.get("kind", "").lower().replace(" ", "")
-                provider_slug = secret_data.get("provider_slug", "")
-                provider_extras = provider_info.get("extras", {})
+                secret_provider_kind = (
+                    provider_info.get("kind", "").lower().replace(" ", "")
+                )
+                secret_provider_slug = secret_data.get("provider_slug", "")
+                secret_provider_models = secret_data.get("models", "")
+                secret_provider_extras = provider_info.get("extras", {})
 
-                if provider_kind == provider_name or provider_slug == provider_name:
-                    if provider_extras:
-                        provider_settings.update(provider_extras)
+                if (
+                    request_provider_kind == secret_provider_kind
+                    and request_provider_slug == secret_provider_slug
+                    and request_provider_model in secret_provider_models
+                ):
+                    if secret_provider_extras:
+                        provider_settings.update(secret_provider_extras)
                 continue
 
+        if len(provider_settings.keys()) <= 1:
+            return None
+
         return provider_settings
 
     @staticmethod
@@ -251,7 +264,7 @@ class SecretsManager:
         # STEP 1: get vault secrets from route context and transform it
         secrets = RunningContext.get().secrets
         if not secrets:
-            return []
+            return None
 
         # STEP 1b: Parse secrets into usable format
         secrets = SecretsManager._parse_secrets(secrets=secrets)
@@ -320,4 +333,7 @@ class SecretsManager:
                         provider_settings.update(secret_provider_extras)
                 continue
 
+        if len(provider_settings.keys()) <= 1:
+            return None
+
         return provider_settings

agenta-0.64.1/agenta/sdk/middleware/vault.py

@@ -0,0 +1,333 @@
+from os import getenv
+from json import dumps
+from typing import Callable, Dict, Optional, List, Any
+
+import httpx
+from fastapi import FastAPI, Request
+from starlette.middleware.base import BaseHTTPMiddleware
+
+from agenta.sdk.utils.logging import get_module_logger
+from agenta.sdk.utils.constants import TRUTHY
+from agenta.sdk.utils.cache import TTLLRUCache
+from agenta.sdk.utils.exceptions import suppress, display_exception
+from agenta.client.backend.types import SecretDto as SecretDTO
+from agenta.client.backend.types import (
+    StandardProviderDto as StandardProviderDTO,
+    StandardProviderSettingsDto as StandardProviderSettingsDTO,
+)
+
+import agenta as ag
+
+log = get_module_logger(__name__)
+
+
+AGENTA_RUNTIME_PREFIX = getenv("AGENTA_RUNTIME_PREFIX", "")
+
+_ALWAYS_ALLOW_LIST = [
+    f"{AGENTA_RUNTIME_PREFIX}/health",
+    f"{AGENTA_RUNTIME_PREFIX}/openapi.json",
+]
+
+_PROVIDER_KINDS = [
+    "openai",
+    "cohere",
+    "anyscale",
+    "deepinfra",
+    "alephalpha",
+    "groq",
+    "mistral",
+    "mistralai",
+    "anthropic",
+    "perplexityai",
+    "togetherai",
+    "openrouter",
+    "gemini",
+]
+
+_AUTH_ENABLED = (
+    getenv("AGENTA_SERVICE_MIDDLEWARE_AUTH_ENABLED", "true").lower() in TRUTHY
+)
+
+_CACHE_ENABLED = (
+    getenv("AGENTA_SERVICE_MIDDLEWARE_CACHE_ENABLED", "true").lower() in TRUTHY
+)
+
+_cache = TTLLRUCache()
+
+
+class DenyException(Exception):
+    def __init__(
+        self,
+        status_code: int = 403,
+        content: str = "Forbidden",
+    ) -> None:
+        super().__init__()
+
+        self.status_code = status_code
+        self.content = content
+
+
+class VaultMiddleware(BaseHTTPMiddleware):
+    def __init__(self, app: FastAPI):
+        super().__init__(app)
+
+        self.host = ag.DEFAULT_AGENTA_SINGLETON_INSTANCE.host
+
+        self.scope_type = ag.DEFAULT_AGENTA_SINGLETON_INSTANCE.scope_type
+        self.scope_id = ag.DEFAULT_AGENTA_SINGLETON_INSTANCE.scope_id
+
+    async def dispatch(
+        self,
+        request: Request,
+        call_next: Callable,
+    ):
+        request.state.vault = {}
+
+        with suppress():
+            secrets = await self._get_secrets(request)
+
+            request.state.vault = {"secrets": secrets}
+
+        return await call_next(request)
+
+    async def _get_secrets(self, request: Request) -> Optional[Dict]:
+        credentials = request.state.auth.get("credentials")
+
+        headers = None
+        if credentials:
+            headers = {"Authorization": credentials}
+
+        _hash = dumps(
+            {
+                "headers": headers,
+            },
+            sort_keys=True,
+        )
+
+        if _CACHE_ENABLED:
+            secrets_cache = _cache.get(_hash)
+
+            if secrets_cache:
+                secrets = secrets_cache.get("secrets")
+
+                return secrets
+
+        local_secrets: List[Dict[str, Any]] = []
+        allow_secrets = True
+
+        try:
+            if not request.url.path in _ALWAYS_ALLOW_LIST:
+                await self._allow_local_secrets(credentials)
+
+            for provider_kind in _PROVIDER_KINDS:
+                provider = provider_kind
+                key_name = f"{provider.upper()}_API_KEY"
+                key = getenv(key_name)
+
+                if not key:
+                    continue
+
+                secret = SecretDTO(
+                    kind="provider_key",  # type: ignore
+                    data=StandardProviderDTO(
+                        kind=provider,
+                        provider=StandardProviderSettingsDTO(key=key),
+                    ),
+                )
+
+                local_secrets.append(secret.model_dump())
+        except DenyException as e:  # pylint: disable=bare-except
+            log.warning(f"Agenta [secrets] {e.status_code}: {e.content}")
+            allow_secrets = False
+        except:  # pylint: disable=bare-except
+            display_exception("Vault: Local Secrets Exception")
+
+        vault_secrets: List[Dict[str, Any]] = []
+
+        try:
+            async with httpx.AsyncClient() as client:
+                response = await client.get(
+                    f"{self.host}/api/vault/v1/secrets/",
+                    headers=headers,
+                )
+
+                if response.status_code != 200:
+                    vault_secrets = []
+
+                else:
+                    vault_secrets = response.json()
+        except:  # pylint: disable=bare-except
+            display_exception("Vault: Vault Secrets Exception")
+
+        secrets = local_secrets + vault_secrets
+
+        standard_secrets = {}
+        custom_secrets = []
+
+        if local_secrets:
+            for secret in local_secrets:
+                standard_secrets[secret["data"]["kind"]] = secret  # type: ignore
+
+        if vault_secrets:
+            for secret in vault_secrets:
+                if secret["kind"] == "provider_key":  # type: ignore
+                    standard_secrets[secret["data"]["kind"]] = secret  # type: ignore
+                elif secret["kind"] == "custom_provider":  # type: ignore
+                    custom_secrets.append(secret)
+
+        standard_secrets = list(standard_secrets.values())
+
+        secrets = standard_secrets + custom_secrets
+
+        if not allow_secrets:
+            _cache.put(_hash, {"secrets": secrets})
+
+        return secrets
+
+    async def _allow_local_secrets(self, credentials):
+        try:
+            if not _AUTH_ENABLED:
+                return
+
+            if not credentials:
+                raise DenyException(
+                    status_code=401,
+                    content="Invalid credentials. Please check your credentials or login again.",
+                )
+
+            # HEADERS
+            headers = {"Authorization": credentials}
+            # PARAMS
+            params = {}
+            ## SCOPE
+            if self.scope_type and self.scope_id:
+                params["scope_type"] = self.scope_type
+                params["scope_id"] = self.scope_id
+            ## ACTION
+            params["action"] = "view_secret"
+            ## RESOURCE
+            params["resource_type"] = "local_secrets"
+
+            _hash = dumps(
+                {
+                    "headers": headers,
+                    "params": params,
+                },
+                sort_keys=True,
+            )
+
+            access = None
+
+            if _CACHE_ENABLED:
+                access = _cache.get(_hash)
+
+                if isinstance(access, Exception):
+                    raise access
+
+            try:
+                async with httpx.AsyncClient() as client:
+                    try:
+                        response = await client.get(
+                            f"{self.host}/api/permissions/verify",
+                            headers=headers,
+                            params=params,
+                            timeout=30.0,
+                        )
+                    except httpx.TimeoutException as exc:
+                        # log.debug(f"Timeout error while verify secrets access: {exc}")
+                        raise DenyException(
+                            status_code=504,
+                            content=f"Could not verify secrets access: connection to {self.host} timed out. Please check your network connection.",
+                        ) from exc
+                    except httpx.ConnectError as exc:
+                        # log.debug(f"Connection error while verify secrets access: {exc}")
+                        raise DenyException(
+                            status_code=503,
+                            content=f"Could not verify secrets access: connection to {self.host} failed. Please check if agenta is available.",
+                        ) from exc
+                    except httpx.NetworkError as exc:
+                        # log.debug(f"Network error while verify secrets access: {exc}")
+                        raise DenyException(
+                            status_code=503,
+                            content=f"Could not verify secrets access: connection to {self.host} failed. Please check your network connection.",
+                        ) from exc
+                    except httpx.HTTPError as exc:
+                        # log.debug(f"HTTP error while verify secrets access: {exc}")
+                        raise DenyException(
+                            status_code=502,
+                            content=f"Could not verify secrets access: connection to {self.host} failed. Please check if agenta is available.",
+                        ) from exc
+
+                    if response.status_code == 401:
+                        # log.debug("Agenta returned 401 - Invalid credentials")
+                        raise DenyException(
+                            status_code=401,
+                            content="Invalid credentials. Please check your credentials or login again.",
+                        )
+                    elif response.status_code == 403:
+                        # log.debug("Agenta returned 403 - Permission denied")
+                        raise DenyException(
+                            status_code=403,
+                            content="Out of credits. Please set your LLM provider API keys or contact support.",
+                        )
+                    elif response.status_code != 200:
+                        # log.debug(
+                        #     f"Agenta returned {response.status_code} - Unexpected status code"
+                        # )
+                        raise DenyException(
+                            status_code=500,
+                            content=f"Could not verify secrets access: {self.host} returned unexpected status code {response.status_code}. Please try again later or contact support if the issue persists.",
+                        )
+
+                    try:
+                        auth = response.json()
+                    except ValueError as exc:
+                        # log.debug(f"Agenta returned invalid JSON response: {exc}")
+                        raise DenyException(
+                            status_code=500,
+                            content=f"Could not verify secrets access: {self.host} returned unexpected invalid JSON response. Please try again later or contact support if the issue persists.",
+                        ) from exc
+
+                    if not isinstance(auth, dict):
+                        # log.debug(
+                        #     f"Agenta returned invalid response format: {type(auth)}"
+                        # )
+                        raise DenyException(
+                            status_code=500,
+                            content=f"Could not verify secrets access: {self.host} returned unexpected invalid response format. Please try again later or contact support if the issue persists.",
+                        )
+
+                    effect = auth.get("effect")
+
+                    access = effect == "allow"
+
+                    if effect != "allow":
+                        # log.debug("Access denied by Agenta - effect: {effect}")
+                        raise DenyException(
+                            status_code=403,
+                            content="Out of credits. Please set your LLM provider API keys or contact support.",
+                        )
+
+                    return
+
+            except DenyException as deny:
+                _cache.put(_hash, deny)
+
+                raise deny
+            except Exception as exc:  # pylint: disable=bare-except
+                # log.debug(
+                #     f"Unexpected error while verifying credentials (remote): {exc}"
+                # )
+                raise DenyException(
+                    status_code=500,
+                    content=f"Could not verify credentials: unexpected error - {str(exc)}. Please try again later or contact support if the issue persists.",
+                ) from exc
+
+        except DenyException as deny:
+            raise deny
+        except Exception as exc:
+            # log.debug(f"Unexpected error while verifying credentials (local): {exc}")
+            raise DenyException(
+                status_code=500,
+                content=f"Could not verify credentials: unexpected error - {str(exc)}. Please try again later or contact support if the issue persists.",
+            ) from exc