Skip to content

docs: correct withheld-credentials log entry wording (VAP15-79) #1304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jeffrey-hoekman-vapi wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: correct withheld-credentials log entry wording (VAP15-79) #1304

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions fern/server-url/server-authentication.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -407,14 +407,15 @@ For webhooks sent to a server URL supplied in the API request, Vapi also strips

#### Confirming a withheld send in your logs

When Vapi withholds credentials, it also writes an entry to the call's webhook logs:
When Vapi withholds credentials, it also writes an entry to the call's logs:

```text
Assistant credentials withheld from <messageType>: this server url came from an
assistant this request supplied, not from your org configuration
Assistant credentials withheld from <messageType>: this server url came from an assistant this request supplied, not from your org configuration
```

The entry is written **once per message type, not once per send**. Vapi suppresses it for high-volume message types: `model-output`, `speech-update`, `status-update`, `transcript`, `transcript[transcriptType="final"]`, `voice-input`, and `voice-request`.
To find it, search the call's logs for the text `credentials withheld`. Don't rely on the log category filter: the entry is not always filed under the webhook category.

Vapi writes the entry **on each send** of a message type that is not suppressed, so the same entry can repeat within a call. Vapi suppresses it for high-volume message types: `model-output`, `speech-update`, `status-update`, `transcript`, `transcript[transcriptType="final"]`, `voice-input`, and `voice-request`.

<Warning>
A missing log entry on a suppressed type does **not** mean credentials were sent. Credential withholding always happens on this path; only the log entry is suppressed. Check `end-of-call-report`, `call.artifact.upload`, or the session and chat webhooks. At least one of these is logged on every affected call.
Expand Down
Loading